Ensure that default service accounts are not actively used

Kako se proverava

Metod provere: Komanda ljuske

sa=$(kubectl get serviceaccounts -A -o go-template='{{range .items}}{{if eq .metadata.name "default"}}{{.metadata.namespace}} {{.automountServiceAccountToken}}{{"\n"}}{{end}}{{end}}') || exit 1
rb=$(kubectl get rolebindings,clusterrolebindings -A -o go-template='{{range .items}}{{$b:=.metadata.name}}{{$bn:=.metadata.namespace}}{{range .subjects}}{{if eq .kind "ServiceAccount"}}{{if eq .name "default"}}{{if .namespace}}{{.namespace}}{{else}}{{$bn}}{{end}} {{$b}}{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$sa" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gatekeeper-system|azure-arc)$' 'NF && $1 !~ ex && $2!="false" {print "automount: " $1}')
bad2=$(printf '%s\n' "$rb" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gatekeeper-system|azure-arc)$' 'NF && $1 !~ ex {print "binding: " $0}')
if [ -z "$bad$bad2" ]; then echo compliant; else printf '%s\n%s\n' "$bad" "$bad2" | grep . | head -n 25; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Apply the following steps to replace default service-account usage with dedicated, least-privileged workload identities in AKS: • Update workloads to explicitly set a dedicated serviceAccountName instead of inheriting the namespace default service account. • Remove unnecessary RoleBinding and ClusterRoleBinding assignments from the default service account, and keep any remaining access minimal and namespace-scoped. • Set automountServiceAccountToken to false where Kubernetes API access is not required to prevent default token auto-mounting. • Review both the ServiceAccount and Pod settings for automountServiceAccountToken, and treat the Pod value as authoritative when both are defined. • For workloads that need Azure resource access, use Microsoft Entra Workload ID with explicit workload configuration instead of the namespace default service account.

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target aks