+APP.4.4.A9 Use of Kubernetes Service Accounts (S)

APP.4.4.A9 Use of Kubernetes Service Accounts (S)

Pods SHOULD NOT use the "default" service account. Rights SHOULD NOT be granted to the "default" service account. Pods for different applications SHOULD run under their own service accounts. Access rights for the service accounts of the applications' pods SHOULD be limited to those that are strictly necessary.

Pods that do not require a service account SHOULD not be able to view it or have access to corresponding tokens.

Only control plane pods and pods that absolutely need them SHOULD use privileged service accounts.

Automation programs SHOULD each receive their own tokens, even if they share a common service account due to similar tasks.

1. Pregled

1.1 Reference

1.2 Utvrđeni zahtjevi

1.3 Povezani propisi

2. Utvrđeni zahtjevi

Zahtjevi

3. Povezani propisi

Propisi

Povezani zadaci

Poveznice
blocks G 0.14 Interception of Information / Espionage
blocks G 0.21 Manipulation with Hardware or Software
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems