TMA-GKE-4.1.5
Ensure service account tokens are mounted only when Pods require Kubernetes API access
Deskripsi
Service account tokens should be mounted in Pods only when the workload explicitly requires authenticated access to the Kubernetes API server. For workloads that do not need API server access, disable token mounting to reduce unnecessary credential exposure inside the Pod. automountServiceAccountToken controls whether Kubernetes injects a service account credential token into the Pod, and its default value is true. The benchmark marks this recommendation Manual.
Cara pemeriksaan
Metode audit: Tinjauan manual
Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.
Review Kubernetes service accounts and Pods in each namespace to confirm that service account tokens are mounted only where the workload requires authenticated access to the Kubernetes API server. The audit should verify both the service account configuration and the Pod specification, because token mounting can be controlled at either level. The automountServiceAccountToken field defaults to true, so workloads that do not need Kubernetes API access should explicitly set it to false.
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Remediate by disabling service account token mounting and assigning API access only to workloads that require it. Pods that do not need to communicate with the Kubernetes API server should set automountServiceAccountToken=false and workloads that do need API access should use a dedicated Kubernetes service account with narrowly assigned RBAC permissions. In addition, avoiding the default service account and using separate Kubernetes service accounts per workload is recommended.
Properti
- Sistem operasi
- Apa saja
- Tag
- gkepoliciesrbac
- Referensi
- CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.1.5 Ensure service account tokens are mounted only when Pods require Kubernetes API access