The admission control plugin ServiceAccount is not set misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_82
Category - Subcategory	Kubernetes - Native Security Controls
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize

Impact

Automate service accounts management. When you create a pod, if you do not specify a service account, it is automatically assigned the default service account in the same namespace. You should create your own service account and let the API server manage its security tokens.

How to Fix

Kind: Pod [source,go]

{ "apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers:

• command:

• • kube-apiserver

• • --enable-admission-plugins=ServiceAccount image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 ...", }

---