Use dedicated Kubernetes service accounts for OKE workloads

Como é verificado

Método de auditoria: Comando shell

out=$(kubectl get pods -A -o go-template='{{range .items}}{{.metadata.namespace}} {{.metadata.name}} {{.spec.serviceAccountName}}{{"\n"}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && ($3=="default" || $3=="<no")')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Saída esperada

compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Use dedicated Kubernetes service accounts for OKE workloads and associate OCI permissions to those service accounts instead of relying on the namespace default service account or broad node based OCI permissions. Use OKE workload identity for workloads that need OCI resource access. Create one dedicated service account and OCI IAM policy design for each application or distinct permission boundary, and update workload manifests to reference the intended service account explicitly. Disable automatic service account token mounting for workloads that do not need Kubernetes API access. After migrating workloads to dedicated service accounts, restrict access to node or instance principal credentials where applicable so pods cannot inherit broader node credentials.

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

tmaegis scan --target oke