Pod Service Account Token Automatically Mounted

No violationsstackroxmediumdeploy

Protect pod default service account tokens from compromise by minimizing the mounting of the default service account token to only those pods whose application requires interaction with the Kubernetes API.

Rationale: By default, Kubernetes automatically provisions a service account for each pod and mounts the secret at runtime. This service account is not typically used. If this pod is compromised and the compromised user has access to the service account, the service account could be used to escalate privileges within the cluster. To reduce the likelihood of privilege escalation this service account should not be mounted by default unless the pod requires direct access to the Kubernetes API as part of the pods functionality.
Remediation: Add `automountServiceAccountToken: false` or a value distinct from 'default' for the `serviceAccountName` key to the deployment's Pod configuration.

CategoriesPrivilegesSecurity Best Practices

Compliance mappingsView coverage →

CIS Kubernetes Benchmark v1.8: 5.1.55.1.65.7.4
DORA EU 2022/2554: Art. 9.2
ISO/IEC 27001 2022: A.8.2A.8.9
NIST SP 800-53 rev. 5: AC-3AC-6CM-2
PCI DSS 4.0: 2.2.17.2.1
SOC 2 2017 TSC: CC6.1

Generated artifacts

3 of 5 targets supported

pod-service-account-token-automatically-mounted.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: pod-service-account-token-automatically-mounted
  annotations:
    policies.kyverno.io/title: Pod Service Account Token Automatically Mounted
    policies.kyverno.io/category: Privileges, Security Best Practices
    policies.kyverno.io/severity: medium
    policies.kyverno.io/description: Protect pod default service account tokens from compromise by minimizing the mounting of the default service account token to only those pods whose application requires interaction with the Kubernetes API.
    policies.kyverno.io/remediation: "Add `automountServiceAccountToken: false` or a value distinct from 'default' for the `serviceAccountName` key to the deployment's Pod configuration."
    policies.kyverno.io/rationale: By default, Kubernetes automatically provisions a service account for each pod and mounts the secret at runtime. This service account is not typically used. If this pod is compromised and the compromised user has access to the service account, the service account could be used to escalate privileges within the cluster. To reduce the likelihood of privilege escalation this service account should not be mounted by default unless the pod requires direct access to the Kubernetes API as part of the pods functionality.
    policies.io/source: stackrox
    policies.io/source-id: fb8f8732-c31d-496b-8fb1-d5abe6056e27
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: pod-service-account-token-automatically-mounted
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: 'Policy "Pod Service Account Token Automatically Mounted" violated: Protect pod default service account tokens from compromise by minimizing the mounting of the default service account token to only those pods whose application requires interaction with the Kubernetes API.'
        deny:
          conditions:
            all:
              - key: "{{ request.object.spec.automountServiceAccountToken || `true` }}"
                operator: Equals
                value: true
              - key: "{{ request.object.spec.serviceAccountName || 'default' }}"
                operator: AnyIn
                value:
                  - default
              - key: "{{ request.namespace }}"
                operator: AnyNotIn
                value:
                  - kube-system
      exclude:
        any:
          - resources:
              namespaces:
                - openshift-config-machine-operator
          - resources:
              namespaces:
                - openshift-config-machine-operator
          - resources:
              namespaces:
                - openshift-config-machine-operator
          - resources:
              namespaces:
                - openshift-config-machine-operator
          - resources:
              namespaces:
                - openshift-vsphere-infra
          - resources:
              namespaces:
                - openshift-vsphere-infra
          - resources:
              namespaces:
                - openshift-vsphere-infra
          - resources:
              namespaces:
                - openshift-kube-apiserver
          - resources:
              namespaces:
                - openshift-kube-apiserver
          - resources:
              namespaces:
                - openshift-kube-apiserver
          - resources:
              namespaces:
                - openshift-kube-scheduler
          - resources:
              namespaces:
                - openshift-kube-scheduler
          - resources:
              namespaces:
                - openshift-etcd
          - resources:
              namespaces:
                - openshift-etcd
          - resources:
              namespaces:
                - openshift-kube-controller-manager
          - resources:
              namespaces:
                - openshift-kube-controller-manager
          - resources:
              namespaces:
                - openshift-security
          - resources:
              namespaces:
                - openshift-kube-apiserver
          - resources:
              namespaces:
                - openshift-kube-scheduler
          - resources:
              namespaces:
                - openshift-etcd
          - resources:
              namespaces:
                - openshift-kube-controller-manager
          - resources:
              namespaces:
                - openshift-route-monitor-operator
          - resources:
              namespaces:
                - openshift-monitoring
          - resources:
              namespaces:
                - openshift-console
          - resources:
              namespaces:
                - openshift-cluster-storage-operator
          - resources:
              namespaces:
                - openshift-network-operator
          - resources:
              namespaces:
                - openshift-network-diagnostics
          - resources:
              namespaces:
                - openshift-machine-config-operator
          - resources:
              namespaces:
                - openshift-ingress-canary
          - resources:
              namespaces:
                - open-cluster-management-agent-addon
          - resources:
              namespaces:
                - openshift-multus
          - resources:
              namespaces:
                - openshift-validation-webhook

IR (canonical)

{
  "id": "fb8f8732-c31d-496b-8fb1-d5abe6056e27",
  "name": "Pod Service Account Token Automatically Mounted",
  "description": "Protect pod default service account tokens from compromise by minimizing the mounting of the default service account token to only those pods whose application requires interaction with the Kubernetes API.",
  "rationale": "By default, Kubernetes automatically provisions a service account for each pod and mounts the secret at runtime. This service account is not typically used. If this pod is compromised and the compromised user has access to the service account, the service account could be used to escalate privileges within the cluster. To reduce the likelihood of privilege escalation this service account should not be mounted by default unless the pod requires direct access to the Kubernetes API as part of the pods functionality.",
  "remediation": "Add `automountServiceAccountToken: false` or a value distinct from 'default' for the `serviceAccountName` key to the deployment's Pod configuration.",
  "severity": "medium",
  "categories": [
    "Privileges",
    "Security Best Practices"
  ],
  "lifecycle": [
    "deploy"
  ],
  "eventSource": "none",
  "scope": [],
  "exclusions": [
    {
      "name": "kube-rbac-proxy-crio-bm-ocp-shift-left-vxhch-master-2.c.acs-team-temp-dev.internal",
      "namespace": "openshift-config-machine-operator"
    },
    {
      "name": "kube-rbac-proxy-crio-bm-ocp-shift-left-vxhch-master-1.c.acs-team-temp-dev.internal",
      "namespace": "openshift-config-machine-operator"
    },
    {
      "name": "kube-rbac-proxy-crio-bm-ocp-shift-left-vxhch-master-0.c.acs-team-temp-dev.internal",
      "namespace": "openshift-config-machine-operator"
    },
    {
      "name": "kube-rbac-proxy-crio-bm-ocp-shift-left-vxhch-worker-c-cfh9c",
      "namespace": "openshift-config-machine-operator"
    },
    {
      "name": "haproxy-.*",
      "namespace": "openshift-vsphere-infra"
    },
    {
      "name": "keepalived-.*",
      "namespace": "openshift-vsphere-infra"
    },
    {
      "name": "coredns-.*",
      "namespace": "openshift-vsphere-infra"
    },
    {
      "name": "apiserver-watcher-.*",
      "namespace": "openshift-kube-apiserver"
    },
    {
      "name": "kube-apiserver-.*",
      "namespace": "openshift-kube-apiserver"
    },
    {
      "name": "kube-apiserver-guard-.*",
      "namespace": "openshift-kube-apiserver"
    },
    {
      "name": "openshift-kube-scheduler-.*",
      "namespace": "openshift-kube-scheduler"
    },
    {
      "name": "openshift-kube-scheduler-guard-.*",
      "namespace": "openshift-kube-scheduler"
    },
    {
      "name": "etcd-.*",
      "namespace": "openshift-etcd"
    },
    {
      "name": "etcd-guard-.*",
      "namespace": "openshift-etcd"
    },
    {
      "name": "kube-controller-manager-.*",
      "namespace": "openshift-kube-controller-manager"
    },
    {
      "name": "kube-controller-manager-guard.*",
      "namespace": "openshift-kube-controller-manager"
    },
    {
      "name": "splunkforwarder-ds",
      "namespace": "openshift-security"
    },
    {
      "name": "Don't alert on namespace openshift-kube-apiserver",
      "namespace": "openshift-kube-apiserver"
    },
    {
      "name": "Don't alert on namespace openshift-kube-scheduler",
      "namespace": "openshift-kube-scheduler"
    },
    {
      "name": "Don't alert on namespace openshift-etcd",
      "namespace": "openshift-etcd"
    },
    {
      "name": "Don't alert on namespace openshift-kube-controller-manager",
      "namespace": "openshift-kube-controller-manager"
    },
    {
      "name": "blackbox-exporter",
      "namespace": "openshift-route-monitor-operator"
    },
    {
      "name": "token-refresher",
      "namespace": "openshift-monitoring"
    },
    {
      "name": "downloads",
      "namespace": "openshift-console"
    },
    {
      "name": "csi-snapshot-webhook",
      "namespace": "openshift-cluster-storage-operator"
    },
    {
      "name": "network-operator",
      "namespace": "openshift-network-operator"
    },
    {
      "name": "network-check-target",
      "namespace": "openshift-network-diagnostics"
    },
    {
      "name": "machine-config-operator",
      "namespace": "openshift-machine-config-operator"
    },
    {
      "name": "ingress-canary",
      "namespace": "openshift-ingress-canary"
    },
    {
      "name": "cluster-proxy-service-proxy",
      "namespace": "open-cluster-management-agent-addon"
    },
    {
      "name": "multus",
      "namespace": "openshift-multus"
    },
    {
      "name": "validation-webhook",
      "namespace": "openshift-validation-webhook"
    }
  ],
  "enforcement": {
    "failBuild": false
  },
  "expression": {
    "op": "and",
    "children": [
      {
        "op": "criterion",
        "field": "automount-service-account-token",
        "values": [
          "true"
        ],
        "valuesOp": "or",
        "negate": false
      },
      {
        "op": "criterion",
        "field": "service-account",
        "values": [
          "default"
        ],
        "valuesOp": "or",
        "negate": false
      },
      {
        "op": "criterion",
        "field": "namespace",
        "values": [
          "kube-system"
        ],
        "valuesOp": "or",
        "negate": true
      }
    ]
  },
  "disabled": false
}

Original StackRox JSON

{
  "id": "fb8f8732-c31d-496b-8fb1-d5abe6056e27",
  "name": "Pod Service Account Token Automatically Mounted",
  "description": "Protect pod default service account tokens from compromise by minimizing the mounting of the default service account token to only those pods whose application requires interaction with the Kubernetes API.",
  "rationale": "By default, Kubernetes automatically provisions a service account for each pod and mounts the secret at runtime. This service account is not typically used. If this pod is compromised and the compromised user has access to the service account, the service account could be used to escalate privileges within the cluster. To reduce the likelihood of privilege escalation this service account should not be mounted by default unless the pod requires direct access to the Kubernetes API as part of the pods functionality.",
  "remediation": "Add `automountServiceAccountToken: false` or a value distinct from 'default' for the `serviceAccountName` key to the deployment's Pod configuration.",
  "disabled": false,
  "categories": [
    "Privileges",
    "Security Best Practices"
  ],
  "lifecycleStages": [
    "DEPLOY"
  ],
  "eventSource": "NOT_APPLICABLE",
  "exclusions": [
    {
      "name": "Don't alert on deployment kube-rbac-proxy-crio-bm-ocp-shift-left-vxhch-master-2.c.acs-team-temp-dev.internal in namespace openshift-config-machine-operator",
      "deployment": {
        "name": "kube-rbac-proxy-crio-bm-ocp-shift-left-vxhch-master-2.c.acs-team-temp-dev.internal",
        "scope": {
          "cluster": "",
          "namespace": "openshift-config-machine-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment kube-rbac-proxy-crio-bm-ocp-shift-left-vxhch-master-1.c.acs-team-temp-dev.internal in namespace openshift-config-machine-operator",
      "deployment": {
        "name": "kube-rbac-proxy-crio-bm-ocp-shift-left-vxhch-master-1.c.acs-team-temp-dev.internal",
        "scope": {
          "cluster": "",
          "namespace": "openshift-config-machine-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment kube-rbac-proxy-crio-bm-ocp-shift-left-vxhch-master-0.c.acs-team-temp-dev.internal in namespace openshift-config-machine-operator",
      "deployment": {
        "name": "kube-rbac-proxy-crio-bm-ocp-shift-left-vxhch-master-0.c.acs-team-temp-dev.internal",
        "scope": {
          "cluster": "",
          "namespace": "openshift-config-machine-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment kube-rbac-proxy-crio-bm-ocp-shift-left-vxhch-worker-c-cfh9c in namespace openshift-config-machine-operator",
      "deployment": {
        "name": "kube-rbac-proxy-crio-bm-ocp-shift-left-vxhch-worker-c-cfh9c",
        "scope": {
          "cluster": "",
          "namespace": "openshift-config-machine-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment haproxy-* in namespace openshift-vsphere-infra",
      "deployment": {
        "name": "haproxy-.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-vsphere-infra",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment keepalived in namespace openshift-vsphere-infra",
      "deployment": {
        "name": "keepalived-.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-vsphere-infra",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment coredns-* in namespace openshift-vsphere-infra",
      "deployment": {
        "name": "coredns-.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-vsphere-infra",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment apiserver-watcher-* in namespace openshift-kube-apiserver",
      "deployment": {
        "name": "apiserver-watcher-.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-apiserver",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment kube-apiserver-* in namespace openshift-kube-apiserver",
      "deployment": {
        "name": "kube-apiserver-.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-apiserver",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment kube-apiserver-guard-* in namespace openshift-kube-apiserver",
      "deployment": {
        "name": "kube-apiserver-guard-.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-apiserver",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment openshift-kube-scheduler-* in namespace openshift-kube-scheduler",
      "deployment": {
        "name": "openshift-kube-scheduler-.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-scheduler",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment openshift-kube-scheduler-guard-* in namespace openshift-kube-scheduler",
      "deployment": {
        "name": "openshift-kube-scheduler-guard-.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-scheduler",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment etcd-* in namespace openshift-etcd",
      "deployment": {
        "name": "etcd-.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-etcd",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment etcd-guard-* in namespace openshift-etcd",
      "deployment": {
        "name": "etcd-guard-.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-etcd",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment kube-controller-manager-* in namespace openshift-kube-controller-manager",
      "deployment": {
        "name": "kube-controller-manager-.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-controller-manager",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment kube-controller-manager-guard* in namespace openshift-kube-controller-manager",
      "deployment": {
        "name": "kube-controller-manager-guard.*",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-controller-manager",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment splunkforwarder-ds in openshift-security namespace",
      "deployment": {
        "name": "splunkforwarder-ds",
        "scope": {
          "cluster": "",
          "namespace": "openshift-security",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on namespace openshift-kube-apiserver",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-apiserver",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on namespace openshift-kube-scheduler",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-scheduler",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on namespace openshift-etcd",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-etcd",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on namespace openshift-kube-controller-manager",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-kube-controller-manager",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment blackbox-exporter in  openshift-route-monitor-operator namespace",
      "deployment": {
        "name": "blackbox-exporter",
        "scope": {
          "cluster": "",
          "namespace": "openshift-route-monitor-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment token-refresher in openshift-monitoring namespace",
      "deployment": {
        "name": "token-refresher",
        "scope": {
          "cluster": "",
          "namespace": "openshift-monitoring",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment downloads in openshift-console namespace",
      "deployment": {
        "name": "downloads",
        "scope": {
          "cluster": "",
          "namespace": "openshift-console",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment csi-snapshot-webhook in openshift-cluster-storage-operator namepsace",
      "deployment": {
        "name": "csi-snapshot-webhook",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-storage-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment network-operator in openshift-network-operator namespace",
      "deployment": {
        "name": "network-operator",
        "scope": {
          "cluster": "",
          "namespace": "openshift-network-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment network-check-target in openshift-network-diagnostics Namespace",
      "deployment": {
        "name": "network-check-target",
        "scope": {
          "cluster": "",
          "namespace": "openshift-network-diagnostics",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment machine-config-operator in openshift-machine-config-operator Namespace",
      "deployment": {
        "name": "machine-config-operator",
        "scope": {
          "cluster": "",
          "namespace": "openshift-machine-config-operator",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment ingress-canary in openshift-ingress-canary Namespace",
      "deployment": {
        "name": "ingress-canary",
        "scope": {
          "cluster": "",
          "namespace": "openshift-ingress-canary",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment cluster-proxy-service-proxy in namespace open-cluster-management-agent-addon ",
      "deployment": {
        "name": "cluster-proxy-service-proxy",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-agent-addon",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment multus in namespace openshift-multus",
      "deployment": {
        "name": "multus",
        "scope": {
          "cluster": "",
          "namespace": "openshift-multus",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment validation-webhook in namespace openshift-validation-webhook",
      "deployment": {
        "name": "validation-webhook",
        "scope": {
          "cluster": "",
          "namespace": "openshift-validation-webhook",
          "label": null
        }
      },
      "image": null
    }
  ],
  "scope": [],
  "severity": "MEDIUM_SEVERITY",
  "enforcementActions": [],
  "policySections": [
    {
      "sectionName": "",
      "policyGroups": [
        {
          "fieldName": "Automount Service Account Token",
          "booleanOperator": "OR",
          "negate": false,
          "values": [
            {
              "value": "true"
            }
          ]
        },
        {
          "fieldName": "Service Account",
          "booleanOperator": "OR",
          "negate": false,
          "values": [
            {
              "value": "default"
            }
          ]
        },
        {
          "fieldName": "Namespace",
          "booleanOperator": "OR",
          "negate": true,
          "values": [
            {
              "value": "kube-system"
            }
          ]
        }
      ]
    }
  ],
  "notifiers": [],
  "lastUpdated": null,
  "SORTName": "",
  "SORTLifecycleStage": "",
  "SORTEnforcement": false,
  "policyVersion": "1.1",
  "mitreAttackVectors": [],
  "criteriaLocked": true,
  "mitreVectorsLocked": true,
  "isDefault": true,
  "source": "IMPERATIVE"
}