Detections
Analytics

4.1.5 Ensure service account tokens are mounted only when Pods require Kubernetes API access

Information

Service account tokens should be mounted in Pods only when the workload explicitly requires authenticated access to the Kubernetes API server. For workloads that do not need API server access, disable token mounting to reduce unnecessary credential exposure inside the Pod. automountServiceAccountToken controls whether Kubernetes injects a service account credential token into the Pod, and its default value is true.

Mounting service account tokens into Pods increases the impact of a Pod compromise because the token can be used to make authenticated requests to the Kubernetes API server using the permissions assigned to the Pod's Kubernetes service account. This risk is higher when workloads use shared service accounts, the namespace default service account, or service accounts with broad RBAC permissions.

Disabling automatic token mounting for Pods that do not need Kubernetes API access removes an unnecessary credential from the workload runtime environment and supports least privilege. Workloads that do need API access should use a dedicated Kubernetes service account with narrowly assigned RBAC permissions.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Remediate by disabling service account token mounting and assigning API access only to workloads that require it. Pods that do not need to communicate with the Kubernetes API server should set automountServiceAccountToken=false and workloads that do need API access should use a dedicated Kubernetes service account with narrowly assigned RBAC permissions. In addition, avoiding the default service account and using separate Kubernetes service accounts per workload is recommended.

 -

Set automountServiceAccountToken=false in Pod or workload specifications that do not require Kubernetes API access

 -

Create dedicated Kubernetes service accounts for workloads that require API access instead of relying on the namespace default service account

 -

Grant only the required RBAC permissions to those service accounts through least privilege Roles, ClusterRoles, RoleBindings, or ClusterRoleBindings

 -

Set automountServiceAccountToken=false on service accounts where token mounting should be disabled by default

Impact:

Pods without mounted service account tokens cannot make authenticated requests to the Kubernetes API server unless another approved authentication mechanism is provided. Applications, controllers, jobs, or automation that rely on cluster Kubernetes API clients may fail until they are updated to use an explicit Kubernetes service account with the required RBAC permissions.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|14.7

Plugin: GCP

Control ID: 15a79d049808bbee7d755ef1bb5a56e35d5d2520adfcff25d96159548609f010