Ensure service account tokens are mounted only when Pods require Kubernetes API access

高レベル 1手動レビューgke

説明

Service account tokens should be mounted in Pods only when the workload explicitly requires authenticated access to the Kubernetes API server. For workloads that do not need API server access, disable token mounting to reduce unnecessary credential exposure inside the Pod. automountServiceAccountToken controls whether Kubernetes injects a service account credential token into the Pod, and its default value is true. The benchmark marks this recommendation Manual.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Review Kubernetes service accounts and Pods in each namespace to confirm that service account tokens are mounted only where the workload requires authenticated access to the Kubernetes API server. The audit should verify both the service account configuration and the Pod specification, because token mounting can be controlled at either level. The automountServiceAccountToken field defaults to true, so workloads that do not need Kubernetes API access should explicitly set it to false.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Remediate by disabling service account token mounting and assigning API access only to workloads that require it. Pods that do not need to communicate with the Kubernetes API server should set automountServiceAccountToken=false and workloads that do need API access should use a dedicated Kubernetes service account with narrowly assigned RBAC permissions. In addition, avoiding the default service account and using separate Kubernetes service accounts per workload is recommended.

プロパティ

オペレーティングシステム: すべて
タグ: gkepoliciesrbac
参照: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.1.5 Ensure service account tokens are mounted only when Pods require Kubernetes API access