Kubernetes YAML Misconfiguration Can Expose an Entire GCP Organization
Developers who need to create cloud resources like databases or storage buckets traditionally rely on service account keys — JSON credential files that authenticate them to the cloud provider. These files create serious security problems: they get copied, emailed, committed to Git repositories, and forgotten when employees leave. This widespread issue is known as secret sprawl, a situation where cloud credentials scatter across machines and codebases in ways that are difficult to audit and rotate.
The Kubernetes community addresses this through GitOps operators, where developers simply write YAML files describing the resources they need and commit them to Git. A controller running inside the cluster reads those files and creates the cloud resources on their behalf, so developers hold no cloud credentials at all. Google's implementation, Kubernetes Config Connector (KCC), runs inside GKE clusters and watches for configuration files describing Google Cloud resources, calling the appropriate APIs to provision them using Workload Identity.
The security concern arises because KCC authenticates through a Google service account controlled by the platform team, and this account often receives broad permissions. Since KCC may manage infrastructure spanning multiple projects, folders, or an entire organization, it can be granted powerful roles like owner or resource manager. A single compromised YAML submission or controller exploit can therefore give an attacker control over an entire GCP organization, turning a convenience feature into a critical attack vector.