The --service-account-key-file argument is not set appropriately misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_97
Category - Subcategory	Kubernetes - Native Security Controls
Provider	OTHER
Severity	MEDIUM
Framework	Helm, Kubernetes, Kustomize

Impact

Explicitly set a service account public key file for service accounts on the apiserver. By default, if no --service-account-key-file is specified to the apiserver, it uses the private key from the TLS serving certificate to verify service account tokens. To ensure that the keys for service account tokens could be rotated as needed, a separate public/private key pair should be used for signing service account tokens. Hence, the public key should be specified to the apiserver with --service-account-key-file.

How to Fix

Kind: Pod [source,go]

{ "apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers:

• command:
• • kube-apiserver
• • --service-account-key-file=/keys/key.pem image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 ...", }

---