dirsigler / uptime-kuma-helm

This Helm Chart installs Uptime-Kuma from @louislam to your Kubernetes Cluster.
https://helm.irsigler.cloud
GNU General Public License v3.0
151 stars 53 forks source link

fix: set automountServiceAccountToken to false when default service account is used #172

Closed wittdennis closed 1 month ago

wittdennis commented 1 month ago

Description of the change

Sets automountServiceAccountToken: false when the default service account is used.

Benefits

This would lead to a more secure setup.

Possible drawbacks

None that come to my mind

Additional information

We follow the CIS Kubernetes Benchmark recommendations for a secure Kubernetes cluster setup.

As per point 5.1.5 Ensure that default service accounts are not actively used: The default service account should not be used to ensure that rights granted to applications can be more easily audited and reviewed.

The suggested remediation is: Create explicit service accounts wherever a Kubernetes workload requires specific access to the Kubernetes API server. Modify the configuration of each default service account to include this value:

automountServiceAccountToken: false

Checklist

tibuntu commented 1 month ago

@dirsigler any chance this is going to be reviewed soon?

dirsigler commented 1 month ago

Thank you very much for your patience and the contribution!