Detections
Analytics

4.1.4 Ensure that default service accounts are not actively used

Information

The Kubernetes default service account should not be actively used by application workloads. Instead, each workload should use a dedicated Kubernetes service account so permissions can be explicitly assigned, audited, and reviewed. Create a Kubernetes service account for each workload and not use the default service account.

Kubernetes creates a default service account in each namespace, and Pods that do not specify serviceAccountName are automatically assigned that default service account. If RBAC permissions are bound to the default service account, any Pod in that namespace that omits an explicit service account can unintentionally inherit those permissions.

Where Kubernetes API access is required, create a dedicated Kubernetes service account for the workload and grant only the required RBAC permissions through a Role or ClusterRole binding. If the Pod does not need Kubernetes API access, set automountServiceAccountToken=false so a service account token is not automatically mounted into the Pod. The automountServiceAccountToken field defaults to true, and disable token when Pods do not need to communicate with the API server.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Each workload that requires Kubernetes API access should have its own service account with narrowly defined permissions. Workloads that do not need Kubernetes API access should disable automatic token mounting to reduce unnecessary credential exposure. For Google Cloud API access, use Workload Identity Federation for GKE instead of relying on static credentials in Pods.

 -

Create dedicated Kubernetes service accounts for workloads that require Kubernetes API access

 -

Update workload manifests to specify serviceAccountName instead of relying on the namespace default service account

 -

Remove RoleBinding and ClusterRoleBinding assignments from the default service account that are not needed

 -

Set automountServiceAccountToken=false for Pods that do not need to communicate with the Kubernetes API server

 -

Configure the namespace default service account with automountServiceAccountToken: false and validate affected workloads

Impact:

Workloads that require Kubernetes API access must be updated to specify an explicit Kubernetes service account and receive only the required RBAC permissions. Disabling automatic token mounting or removing default service account permissions can break workloads, controllers, or automation that implicitly depend on the default service account, so changes should be tested before enforcement.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(3), CSCv7|4.3, CSCv7|5.2, CSCv7|16.9

Plugin: GCP

Control ID: fc00dd8777707efc51de9003e780af9648bd1649c9f233312782ecdd684d4caf