Kubeconfig is the configuration file Kubernetes clients use to connect to clusters. It can define one or more clusters, users, and contexts, and it often stores authentication material such as client certificates, bearer tokens, or exec-based login settings. Tools like kubectl read kubeconfig to decide which cluster to talk to and what identity to present.
In security terms, a kubeconfig file is highly sensitive because anyone who gets it may gain the same access as the legitimate user, sometimes including administrator-level privileges. Attackers often look for kubeconfig files on developer laptops, CI/CD runners, shared storage, backups, or exposed containers to pivot into a Kubernetes environment. Defenders should treat kubeconfig as a secret: restrict file permissions, avoid embedding long-lived credentials, use short-lived tokens where possible, rotate access when exposure is suspected, and keep separate contexts for different environments.