custom pki or administrative tooling may legitimately request kubernetes.io/kube-apiserver-client certificates in self-managed clusters. baseline approved operators and tune exclusions for known automation on gke.

Techniques

T1098

Sample rules

GKE Certificate Signing Request API Client Signer Requested

source: elastic
technicques:
- T1098

Description

Detects creation of a GKE CertificateSigningRequest (CSR) that requests the kubernetes.io/kube-apiserver-client signer. This signer issues general API client certificates with few subject restrictions, unlike the restricted kubelet signers used for node certificate rotation. Attackers with CSR permissions use this signer to mint long-lived credentials for privileged identities such as system:kube-controller-manager, enabling persistence and privilege escalation that survives token revocation and RBAC changes.

Detection logic

data_stream.dataset:"gcp.audit" and service.name:"k8s.io" and event.outcome:"success" and
event.action:"io.k8s.certificates.v1.certificatesigningrequests.create" and
gcp.audit.request.spec.signerName:"kubernetes.io/kube-apiserver-client" and
not client.user.email:(
  "system:gcp-controller-manager" or
  "system:serviceaccount:kube-system:certificate-controller"
)