Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE] Turn off automountServiceAccountToken #347

Open
OmarHawk opened this issue Oct 16, 2023 · 0 comments
Open

[FEATURE] Turn off automountServiceAccountToken #347

OmarHawk opened this issue Oct 16, 2023 · 0 comments
Labels

Comments

@OmarHawk
Copy link

Is your feature request related to a problem? Please describe.
For security reasons, mounting the Kubernetes service account token should only be done when absolutely necessary. I doubt, it is required for the use case here, but if so, you can just close this request.

Describe the solution you'd like
Set automountServiceAccountToken in the Pod spec to false by default. At the moment, it is not configurable / settable at all through the helm chart...

Describe alternatives you've considered
If needed, one can also just configure the mount manually for a single container so that the mount is only received for the one really needing it.

Additional context
This is part of a MS Defender for Cloud (MDC) recommendation: "Kubernetes clusters should disable automounting API credentials"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant