KUBERNETES V1.35: RESTRICTING EXECUTABLES INVOKED BY KUBECONFIGS VIA EXEC PLUGIN ALLOWLIST ADDED TO KUBERC

Summary from the TLDR InfoSec newsletter

kubeconfigs can run any executable via the configured exec plugin, which is used to obtain credentials. Kubernetes v1.35 adds two new fields, credentialPluginPolicy and credentialPluginAllowlist, which can be used to restrict the executables that are available to kubectl for obtaining credentials. Currently, the only supported attribute for the allow list is `name` (for an executable name or path), but the SIG is looking to add further support, such as checksums, in the future.