Benchmark: 5.1 RBAC and Service Accounts

Overview

This section contains recommendations for various Kubernetes RBAC policies which can also govern the behavior of software resources, that Kubernetes identifies as service accounts.

Usage

Install the mod:

mkdir dashboards
cd dashboards
powerpipe mod init
powerpipe mod install github.com/turbot/steampipe-mod-kubernetes-compliance

Start the Powerpipe server:

steampipe service start
powerpipe server

Open http://localhost:9033 in your browser and select 5.1 RBAC and Service Accounts.

Run this benchmark in your terminal:

powerpipe benchmark run kubernetes_compliance.benchmark.cis_v170_5_1

Snapshot and share results via Turbot Pipes:

powerpipe benchmark run kubernetes_compliance.benchmark.cis_v170_5_1 --share

Controls

• 5.1.3 Minimize wildcard use in Roles and ClusterRoles
• 5.1.6 Ensure that Service Account Tokens are only mounted where necessary

Tags