Google Kubernetes Engine (GKE)
TMA-GKE-4.1.5
Ensure service account tokens are mounted only when Pods require Kubernetes API access
Descripción
Service account tokens should be mounted in Pods only when the workload explicitly requires authenticated access to the Kubernetes API server. For workloads that do not need API server access, disable token mounting to reduce unnecessary credential exposure inside the Pod. automountServiceAccountToken controls whether Kubernetes injects a service account credential token into the Pod, and its default value is true. The benchmark marks this recommendation Manual.
Cómo se verifica
Método de auditoría: Revisión manual
Review Kubernetes service accounts and Pods in each namespace to confirm that service account tokens are mounted only where the workload requires authenticated access to the Kubernetes API server. The audit should verify both the service account configuration and the Pod specification, because token mounting can be controlled at either level. The automountServiceAccountToken field defaults to true, so workloads that do not need Kubernetes API access should explicitly set it to false.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Remediate by disabling service account token mounting and assigning API access only to workloads that require it. Pods that do not need to communicate with the Kubernetes API server should set automountServiceAccountToken=false and workloads that do need API access should use a dedicated Kubernetes service account with narrowly assigned RBAC permissions. In addition, avoiding the default service account and using separate Kubernetes service accounts per workload is recommended.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- gkepoliciesrbac
- Referencia
- CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.1.5 Ensure service account tokens are mounted only when Pods require Kubernetes API access