Google Kubernetes Engine (GKE)
TMA-GKE-4.1.5
Ensure service account tokens are mounted only when Pods require Kubernetes API access
Mô tả
Service account tokens should be mounted in Pods only when the workload explicitly requires authenticated access to the Kubernetes API server. For workloads that do not need API server access, disable token mounting to reduce unnecessary credential exposure inside the Pod. automountServiceAccountToken controls whether Kubernetes injects a service account credential token into the Pod, and its default value is true. The benchmark marks this recommendation Manual.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Review Kubernetes service accounts and Pods in each namespace to confirm that service account tokens are mounted only where the workload requires authenticated access to the Kubernetes API server. The audit should verify both the service account configuration and the Pod specification, because token mounting can be controlled at either level. The automountServiceAccountToken field defaults to true, so workloads that do not need Kubernetes API access should explicitly set it to false.
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Remediate by disabling service account token mounting and assigning API access only to workloads that require it. Pods that do not need to communicate with the Kubernetes API server should set automountServiceAccountToken=false and workloads that do need API access should use a dedicated Kubernetes service account with narrowly assigned RBAC permissions. In addition, avoiding the default service account and using separate Kubernetes service accounts per workload is recommended.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- gkepoliciesrbac
- Tham chiếu
- CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.1.5 Ensure service account tokens are mounted only when Pods require Kubernetes API access