For me, the largest one mentioned is a known security issue with k8s architecture, which is the lack of support for certificate revocation. So anywhere client

For me, the largest one mentioned is a known security issue with k8s architecture, which is the lack of support for certificate revocation. So anywhere client cert's are used for authN, if one is lost there's no way to revoke it, short of rolling the whole certificate authority. when you combine that with the 200k+ Internet exposed Kubernetes clusters, that's quite a large potential for attack. The GH issue for this has been open since 2015 https://github.com/kubernetes/kubernetes/issues/18982 https://github.com/kubernetes/kubernetes/issues/18982