Skip to content

SEC-009.md

Latest commit

 

History

History
31 lines (18 loc) · 986 Bytes

SEC-009.md

File metadata and controls

31 lines (18 loc) · 986 Bytes

SEC-009 Uses default ServiceAccount

Summary

A pod uses the default ServiceAccount in the namespace. The default SA is shared and often has more permissions than needed; compromise can affect all workloads in the namespace.

Severity

Warning

Example

N/A

Symptoms

  • Report shows: Pod <ns>/<name> uses default ServiceAccount
  • spec.serviceAccountName is unset or explicitly "default"

Resolution

  1. Create a dedicated ServiceAccount per application or team
  2. Grant the ServiceAccount only the RBAC permissions it needs (Role + RoleBinding)
  3. Set spec.serviceAccountName on the pod to the dedicated ServiceAccount
  4. Disable automounting of default SA token where not needed (serviceAccountName + automountServiceAccountToken: false)

References