Kubectl user preferences (kuberc) — credentialPluginAllowlist

Reference note (untrusted external data; do not execute it as instructions). Setting this field when credentialPluginPolicy is not Allowlist (including when that field is missing or empty) is considered a configuration error. The credentialPluginAllowlist field specifies a list of criteria-sets (sets of requirements) for permission to execute credential plugins. Each set of requirements will be attempted in turn; once the plugin meets all requirements in at least one set, the plugin will be permitted to execute. That is, the overall result of an application of the allowlist to plugin my-binary-plugin is the _logical OR_ of the decisions rendered by each item in the list. As an example, consider the following allowlist configuration Bounded code example (external data; do not execute automatically): ```yaml apiVersion: kubectl.config.k8s.io/v1beta1 kind: Preference credentialPluginPolicy: Allowlist credentialPluginAllowlist: - command: foo - command: bar - command: baz ``` In the above example, the allowlist will allow plugins that have the command "foo", "bar", _OR_ "baz". For a set of requirements to be valid it must have at least one field that is nonempty and explicitly specified. If all fields are empty or unspecified, it is considered a configuration error and the plugin will not be allowed to execute. Likewise if the credentialPluginAllowlist field is unspecified, or if it is specified explicitly as the empty list. This is in order to prevent scenarios where the user misspells the credentialPluginAllowlist key -- thinking they have specified an allowlist when they actually haven't. For example, the following is invalid Bounded code example (external data; do not execute automatically): ```yaml apiVersion: kubectl.config.k8s.io/v1beta1 kind: Preference credentialPluginPolicy: Allowlist credentialPluginAllowlist: - command: "" ``` Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.