Use dedicated Kubernetes service accounts for OKE workloads

Cara pemeriksaan

Metode audit: Perintah shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{.metadata.namespace}} {{.metadata.name}} {{.spec.serviceAccountName}}{{"\n"}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && ($3=="default" || $3=="<no")')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Output yang diharapkan

compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Use dedicated Kubernetes service accounts for OKE workloads and associate OCI permissions to those service accounts instead of relying on the namespace default service account or broad node based OCI permissions. Use OKE workload identity for workloads that need OCI resource access. Create one dedicated service account and OCI IAM policy design for each application or distinct permission boundary, and update workload manifests to reference the intended service account explicitly. Disable automatic service account token mounting for workloads that do not need Kubernetes API access. After migrating workloads to dedicated service accounts, restrict access to node or instance principal credentials where applicable so pods cannot inherit broader node credentials.

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

tmaegis scan --target oke