Control: Pods should not refer to a non existing service account

powerpipe control run kubernetes_compliance.control.pod_service_account_not_exist

powerpipe login
powerpipe control run kubernetes_compliance.control.pod_service_account_not_exist --share

select
  coalesce(p.uid, concat(p.path, ':', p.start_line)) as resource,
  case
    when service_account_name is not null and service_account_name <> '' then 'ok'
    else 'alarm'
  end as status,
  case
    when service_account_name is not null and service_account_name <> '' then p.name || ' refer to an existing service account.'
    else p.name || ' does not refer to an existing service account.'
  end as reason,
  p.name as pod_name
  
  , coalesce(p.context_name, '') as context_name, p.namespace, p.source_type, coalesce(p.path || ':' || p.start_line || '-' || p.end_line, '') as path
from
  kubernetes_pod p
  left join kubernetes_service_account a on p.service_account_name = a.name;