42 lines
1.6 KiB
YAML
42 lines
1.6 KiB
YAML
id: k8s-svc-acct-issuer-set
|
|
|
|
info:
|
|
name: Checks if service-account-issuer is correctly configured
|
|
author: princechaddha
|
|
severity: medium
|
|
description: Checks if the service-account-issuer argument is correctly configured in the API server, critical for issuing valid service tokens.
|
|
impact: |
|
|
If the service-account-issuer argument is not set, the API server may issue tokens that are not accepted by other services, leading to authentication failures.
|
|
remediation: |
|
|
Set the service-account-issuer argument to a valid issuer URL in the API server's startup arguments or configuration file. This ensures the tokens issued are trusted across services.
|
|
reference:
|
|
- https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
|
|
tags: cloud,devops,kubernetes,devsecops,api-server,k8s,k8s-cluster-security
|
|
|
|
variables:
|
|
argument: "service-account-issuer"
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- 'kube-apiserver'
|
|
|
|
- type: word
|
|
words:
|
|
- "service-account-issuer"
|
|
negative: true
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- '"API server configuration lacks the " + argument + " argument."'
|
|
# digest: 490a0046304402202befd41f501babe2cad07a6ef72c1299e269b3cabf689e12636ba4f0ccdc7530022002d595a3a01f6b6c2a2292348cf08b3a83b36553fcb9571211d487b2d16efcb0:922c64590222798bb761d5b6d8e72950 |