Control: Automatic mapping of the service account tokens should be disabled in service account
Description
Automatic mapping of service account token should be disabled. By default, Kubernetes automatically provisions a service account when creating a Pod and mounts the account’s secret token within the Pod at runtime. Many containerized applications do not require direct access to the service account as Kubernetes orchestration occurs transparently in the background. If an application is compromised, account tokens in Pods can be gleaned by cyber actors and used to further compromise the cluster. When an application does not need to access the service account directly, Kubernetes administrators should ensure that Pod specifications disable the secret token being mounted. This can be accomplished using the `automountServiceAccountToken: false` directive in the Pod's YAML specification.
Usage
Run the control in your terminal:
powerpipe control run kubernetes_compliance.control.service_account_token_disabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run kubernetes_compliance.control.service_account_token_disabled --shareSQL
This control uses a named query:
select coalesce(uid, concat(path, ':', start_line)) as resource, case when automount_service_account_token then 'alarm' else 'ok' end as status, case when automount_service_account_token then name || ' service account token will be automatically mounted.' else name || ' service account token will not be automatically mounted.' end as reason, name as service_account_name , coalesce(context_name, '') as context_name, namespace, source_type, coalesce(path || ':' || start_line || '-' || end_line, '') as pathfrom kubernetes_service_account;