rke's credentials are stored in the RKE1 Cluster state ConfigMap

QFinch assessment

When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include the following sensitive data:

Potential impact

When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include the following sensitive data: - RancherKubernetesEngineConfig - RKENodeConfig - RKEConfigServices - PrivateRegistries - CloudProvider - BastionHost - CertificatesBundle - Private key - EncryptionConfig - Private key The State type that contains the above info and more can viewed here. While the full-cluster-state configmap is not publicly available (reading it requires access to the RKE cluster), it being a configmap makes it available to non-administrators of the cluster. Because this configmap contains essentially all the information and credentials required to administer the cluster, anyone with permission to read it thereby achieves admin-level access to the cluster (please consult the MITRE ATT&CK - Technique - Unsecured Credentials : Credentials In Files for further information about the associated technique of attack). Important: For the exposure of credentials not related to Rancher and RKE, the final impact severity for confidentiality, integrity and availability is dependent on the permissions the leaked credentials have on their services. It is recommended to review for potentially leaked credentials in this scenario and to change them if deemed necessary.