Kubernetes v1.35: Restricting executables invoked by kubeconfigs via exec plugin allowList added to kuberc

Kubernetes v1.35 introduces a beta feature to restrict which executables kubeconfigs can invoke via exec plugins, protecting against supply-chain attacks.

• •kubectl can silently run arbitrary executables specified in the users[n].exec.command field of a kubeconfig, posing a security risk
• •The new credentialPluginPolicy field in kuberc supports three modes: AllowAll (default), DenyAll, and Allowlist
• •The Allowlist mode lets users specify allowed plugins by full path or basename via credentialPluginAllowlist in kuberc
• •Full path entries are preferred over basename as they narrow the scope of allowed binaries more precisely
• •Future enhancements may include checksum verification (e.g., sha256) and trusted signing key validation for allowed binaries