+APP.4.4.A9 Use of Kubernetes Service Accounts (S)

APP.4.4.A9 Use of Kubernetes Service Accounts (S)

Pods SHOULD NOT use the "default" service account. Rights SHOULD NOT be granted to the "default" service account. Pods for different applications SHOULD run under their own service accounts. Access rights for the service accounts of the applications' pods SHOULD be limited to those that are strictly necessary.

Pods that do not require a service account SHOULD not be able to view it or have access to corresponding tokens.

Only control plane pods and pods that absolutely need them SHOULD use privileged service accounts.

Automation programs SHOULD each receive their own tokens, even if they share a common service account due to similar tasks.

1. Επισκόπηση

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

Απαιτήσεις

3. Σχετικοί κανονισμοί

Κανονισμοί

Συνδεδεμένα ζητήματα

Συνδέσεις
blocks G 0.14 Interception of Information / Espionage
blocks G 0.21 Manipulation with Hardware or Software
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems