derailed / popeye

👀 A Kubernetes cluster resource sanitizer
https://popeyecli.io
Other
5.32k stars 286 forks source link

default service account check #370

Open tylergmuir opened 4 weeks ago

tylergmuir commented 4 weeks ago




I think the check for if a pod is using the default service account should be informational instead of a warning. But there should be a warning if there is a role binding associated with the default account.

The thought process is that just having a pod with the default service account itself isn't an issue, but leveraging the default account with additional permissions likely provides permissions to too many things. But in the case a pod doesn't require any additional permissions within the cluster, leaving it as default I don't think should be seen as bad.