Kubernetes permissions can expose Google Cloud organizations through Config Connector

A configuration of Google Kubernetes Config Connector can let a user with limited cluster access grant themselves broad Google Cloud permissions, security researcher Justin O'Leary found. The user needs permission to create an IAM policy resource in a namespace watched by the connector; the connector then submits the requested change through its own Google service account. If that service account has organization-level authority, Google Cloud accepts a request the Kubernetes user could not make directly. The exposure depends on both broad connector permissions and access to submit the relevant resource. Google says the connector is working as designed and recommends limiting its authority.