search

TremoloSecurity / k8s-idm-lab

Kubernetes Identity Management Lab
Apache License 2.0
25 stars 7 forks source link

Audit policy metadata-only rule should include `serviceaccounts/token` resource #1

Open liggitt opened 3 years ago

liggitt commented 3 years ago

The following files reference a metadata-only audit policy in order to prevent logging request/response contents for sensitive resources:

A recent Kubernetes bugfix means that audit-logging of subresource requests which previously failed will now log successfully. The serviceaccounts/token subresource responds to TokenRequest API calls with a newly minted service account token.

The serviceaccounts/token resource should also be included in the metadata-only audit policy if credentials are not intended to appear in the audit log:

- group: "" # core
  resources: ["secrets", "configmaps", "serviceaccounts/token"]
mlbiam commented 3 years ago

sorry i missed this! i'll get this updated