Ensure that default service accounts are not actively used.

Kako se proverava

Metod provere: Komanda ljuske

sa=$(kubectl get serviceaccounts -A -o go-template='{{range .items}}{{if eq .metadata.name "default"}}{{.metadata.namespace}} {{.automountServiceAccountToken}}{{"\n"}}{{end}}{{end}}') || exit 1
rb=$(kubectl get rolebindings,clusterrolebindings -A -o go-template='{{range .items}}{{$b:=.metadata.name}}{{$bn:=.metadata.namespace}}{{range .subjects}}{{if eq .kind "ServiceAccount"}}{{if eq .name "default"}}{{if .namespace}}{{.namespace}}{{else}}{{$bn}}{{end}} {{$b}}{{"\n"}}{{end}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$sa" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && $2!="false" {print "automount: " $1}')
bad2=$(printf '%s\n' "$rb" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex {print "binding: " $0}')
if [ -z "$bad$bad2" ]; then echo compliant; else printf '%s\n%s\n' "$bad" "$bad2" | grep . | head -n 25; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Create dedicated service accounts for workloads that need Kubernetes API access or OKE workload identity, and update those workloads to explicitly set serviceAccountName rather than relying on the namespace default service account. For workloads that do not need Kubernetes API access, disable service account token auto mounting and avoid using the default service account as the active workload identity. Also review the default service account in each namespace and ensure it is not bound to unnecessary RBAC permissions. Modify the default service account in each application namespace to set: automountServiceAccountToken: false Then validate workload manifests, because a Pod automountServiceAccountToken setting can override the service account setting, and workloads that actually need Kubernetes API access must use an explicitly assigned service account instead of inheriting default.

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target oke