OpenShift Hive / MCE / ACM (vCenter credential exposure): vCenter credentials are written into the ClusterProvision

Impact

vCenter credentials are written into the ClusterProvision object after provisioning a vSphere cluster, so anyone with read access to those objects extracts them - a Kubernetes RBAC read grant becomes hypervisor admin.

Who can reach it

Any user or service account with read access to ClusterProvision objects in the management cluster.

What to do

Apply the Red Hat fix, then rotate the exposed vCenter credentials and audit who holds read on ClusterProvision. Rotation is mandatory here - the credentials are already at rest in etcd and in any cluster backup.

References