All-or-Nothing No More: Taming Kubernetes Impersonation With Granular Controls
Talkat KubeCon + CloudNativeCon + OpenInfra Summit + PyTorch Conference China 2026 · 2026-09-07..09-09·
summary
KEP-5284 rolls out constrained impersonation in beta, adding new authorization verbs that limit which identities can be impersonated and which API verbs the impersonator may execute. Clusters enforce least-privilege for patterns like per-node agents like CSI/CNI and deputy controllers proxying user ops, backed by a feature gate, a migrator to convert unrestricted policies, audit-event hooks, and caching/authorization endpoint checks to keep decision latency low while narrowing blast radius.
AI-written summary · about
chapters (9)
- 0:00Kubernetes impersonation intro
- 3:06Service account impersonation
- 6:22Impersonation verbs and rules
- 9:47Impersonation data exposure
- 12:48Audit event matrix and limits
- 15:35Feature gate and migration
- 17:24Performance and identity API
- 21:32Authorization scenarios
- 23:21Conclusion and CSR plugin
related talks
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
34mTowards a Standardized Identity-based Authorization in Kubernetes
35mSmarter Kubernetes Access Control: A Simpler Approach to Auth
33mHow the Basics Of Kubernetes Auth Scale For Organizations
46mLateral Movements in Kubernetes
26mSecuring Access to Kubernetes Infrastructure with Kubernetes Zero Trust Principles
29mEverything Wrong with K8s Authentication and How We Worked Around It
34mFine-Grained Permissions in K8s: What’s Missing, and How to Fix That