CWE-295: TLS certificate verification disabled for Kubernetes API connections (InsecureSkipVerify: true + Bearer token)

[LeoWSY-hashblue]

The K8s API client hardcodes InsecureSkipVerify: true while sending Bearer tokens (service account credentials) to the Kubernetes API server. An attacker who MITMs the connection can capture cluster admin credentials.

Remediation: Remove InsecureSkipVerify: true. Use proper TLS verification with the cluster's CA certificate.