CKS Security Quest · Service accounts

Remove unnecessary API tokens

A dedicated identity with token automounting disabled at both layers.

CKS-0175 minutes

Task

Namespace jobs contains CronJob reporter, which does not use the Kubernetes API.

  1. Create dedicated ServiceAccount reporter.
  2. Disable automounting on the ServiceAccount.
  3. Use it in the complete CronJob Pod template and explicitly disable automounting there.
  4. Apply and verify both settings.