As per point 5.1.5 Ensure that default service accounts are not actively used:
The default service account should not be used to ensure that rights granted to applications can be more easily audited and reviewed.
The suggested remediation is:
Create explicit service accounts wherever a Kubernetes workload requires specific access to the Kubernetes API server. Modify the configuration of each default service account to include this value:
automountServiceAccountToken: false
Checklist
[X] Chart version bumped in Chart.yaml according to semver.
Description of the change
Sets
automountServiceAccountToken: false
when the default service account is used.Benefits
This would lead to a more secure setup.
Possible drawbacks
None that come to my mind
Additional information
We follow the CIS Kubernetes Benchmark recommendations for a secure Kubernetes cluster setup.
As per point 5.1.5 Ensure that default service accounts are not actively used: The default service account should not be used to ensure that rights granted to applications can be more easily audited and reviewed.
The suggested remediation is: Create explicit service accounts wherever a Kubernetes workload requires specific access to the Kubernetes API server. Modify the configuration of each default service account to include this value:
Checklist
Chart.yaml
according to semver.