Ensure that default service accounts are not actively used

Како се проверава

Метод провере: Команда љуске

sa=$(kubectl get serviceaccounts -A -o go-template='{{range .items}}{{if eq .metadata.name "default"}}{{.metadata.namespace}} {{.automountServiceAccountToken}}{{"\n"}}{{end}}{{end}}') || exit 1
rb=$(kubectl get rolebindings,clusterrolebindings -A -o go-template='{{range .items}}{{$b:=.metadata.name}}{{$bn:=.metadata.namespace}}{{range .subjects}}{{if eq .kind "ServiceAccount"}}{{if eq .name "default"}}{{if .namespace}}{{.namespace}}{{else}}{{$bn}}{{end}} {{$b}}{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$sa" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gmp-system|gmp-public|gke-[a-z0-9-]+)$' 'NF && $1 !~ ex && $2!="false" {print "automount: " $1}')
bad2=$(printf '%s\n' "$rb" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gmp-system|gmp-public|gke-[a-z0-9-]+)$' 'NF && $1 !~ ex {print "binding: " $0}')
if [ -z "$bad$bad2" ]; then echo compliant; else printf '%s\n%s\n' "$bad" "$bad2" | grep . | head -n 25; fi

Очекивани излаз

compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Each workload that requires Kubernetes API access should have its own service account with narrowly defined permissions. Workloads that do not need Kubernetes API access should disable automatic token mounting to reduce unnecessary credential exposure. For Google Cloud API access, use Workload Identity Federation for GKE instead of relying on static credentials in Pods. • Create dedicated Kubernetes service accounts for workloads that require Kubernetes API access • Update workload manifests to specify serviceAccountName instead of relying on the namespace default service account • Remove RoleBinding and ClusterRoleBinding assignments from the default service account that are not needed • Set automountServiceAccountToken=false for Pods that do not need to communicate with the Kubernetes API server • Configure the namespace default service account with automountServiceAccountToken: false ...

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

tmaegis scan --target gke