Service account ‘automountServiceAccountToken’ should be set to ‘false’¶
Description¶
Avoid automounting service account tokens. Service account tokens are used to authenticate requests from in-cluster processes to the Kubernetes API server. Many workloads do not need to communicate with the API server and hence should have automountServiceAccountToken set to false.
Remediation Steps¶
Kubernetes Manifest (YAML)¶
Ensure that a Kubernetes.Pod or Kubernetes.ServiceAccount has the
automountServiceAccountToken
field set tofalse
. By default, a service account token is automounted in all pods.
Example Configuration¶
Pod:
apiVersion: v1
kind: Pod
metadata:
name: hello
spec:
automountServiceAccountToken: false
containers:
- name: hello
image: busybox
command: ['sh', '-c', 'echo "Hello, Kubernetes!" && sleep 3600']
# other required fields here
Service account:
apiVersion: v1
kind: ServiceAccount
metadata:
name: hello
automountServiceAccountToken: false
# other required fields here