CNTR-K8-000220 - The Kubernetes Controller Manager must create unique service accounts for each work payload.


The Kubernetes Controller Manager is a background process that embeds core control loops regulating cluster system state through the API Server. Every process executed in a pod has an associated service account. By default, service accounts use the same credentials for authentication. Implementing the default settings poses a High risk to the Kubernetes Controller Manager. Setting the use-service-account-credential value lowers the attack surface by generating unique service accounts settings for each controller instance.


Edit the Kubernetes Controller Manager manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Control Plane. Set the value of 'use-service-account-credentials' to 'true'.

See Also

Item Details

References: CAT|I, CCI|CCI-000015, Rule-ID|SV-242381r879522_rule, STIG-ID|CNTR-K8-000220, Vuln-ID|V-242381

Plugin: Unix

Control ID: 38691e2f0f9d380057918b32be420148853141393e8b3041d07a7f22592807e5