mirror of
https://github.com/aquasecurity/kube-hunter.git
synced 2026-08-21 05:06:32 +00:00
25 lines
819 B
Markdown
25 lines
819 B
Markdown
---
|
|
vid: KHV005
|
|
title: Access to Kubernetes API
|
|
categories: [Information Disclosure, Unauthenticated Access]
|
|
---
|
|
|
|
# {{ page.vid }} - {{ page.title }}
|
|
|
|
## Issue description
|
|
|
|
Kubernetes API was accessed with Pod Service Account or without Authentication (see report message for details).
|
|
|
|
## Remediation
|
|
|
|
Secure access to your Kubernetes API.
|
|
|
|
It is recommended to explicitly specify a Service Account for all of your workloads (`serviceAccountName` in `Pod.Spec`), and manage their permissions according to the least privilege principal.
|
|
|
|
Consider opting out automatic mounting of SA token using `automountServiceAccountToken: false` on `ServiceAccount` resource or `Pod.spec`.
|
|
|
|
|
|
## References
|
|
|
|
- [Configure Service Accounts for Pods](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/)
|