With node root and forged service-account tokens valid for 24 hours, the agent read the cluster’s secret objects, including a production object holding 136 keys. With node root and forged service-account tokens valid for 24 hours, the agent read the cluster’s secret objects, including a production object holding 136 keys.

Game over.