Ensure Service Account Tokens Are Only Mounted Where Necessary

#!/usr/bin/env bash
set -euo pipefail

# Automation: Disable automountServiceAccountToken where not explicitly required
# Scope: Run on any machine with kubectl and jq installed, authenticated to the cluster.
#
# WARNING:
# - This will PATCH pods and serviceaccounts that do not explicitly set
#   automountServiceAccountToken=false to set it to false.
# - It cannot distinguish workloads that truly need API access from those that don't.
#   Review candidates before/after running, or restrict via namespace/label filters.

# Optional: limit scope by namespace (uncomment and set, or leave empty for all)
NAMESPACE_FILTER=""

# Helper to run kubectl with optional namespace filter
k() {
  if [[ -n "$NAMESPACE_FILTER" ]]; then
    kubectl -n "$NAMESPACE_FILTER" "$@"
  else
    kubectl "$@"
  fi
}

echo "Discovering pods with automountServiceAccountToken not explicitly set to false..."

# List pods that currently have automountServiceAccountToken != false
pods_json=$(k get pods --all-namespaces -o json)

pods_to_patch=$(echo "$pods_json" | jq -r '
  .items[]
  | select(.spec.automountServiceAccountToken != false)
  | "\(.metadata.namespace) \(.metadata.name)"')

if [[ -z "$pods_to_patch" ]]; then
  echo "No pods require patch for automountServiceAccountToken."
else
  echo "Patching pods to set spec.automountServiceAccountToken=false..."
  while read -r ns name; do
    [[ -z "$ns" || -z "$name" ]] && continue
    echo "  Patching pod: $ns/$name"
    k -n "$ns" patch pod "$name" --type=merge -p '{
      "spec": {
        "automountServiceAccountToken": false
      }
    }' >/dev/null
  done <<< "$pods_to_patch"
fi

echo "Discovering ServiceAccounts with automountServiceAccountToken not explicitly set to false..."

sa_json=$(k get serviceaccounts --all-namespaces -o json)

sa_to_patch=$(echo "$sa_json" | jq -r '
  .items[]
  | select(.automountServiceAccountToken != false)
  | "\(.metadata.namespace) \(.metadata.name)"')

if [[ -z "$sa_to_patch" ]]; then
  echo "No ServiceAccounts require patch for automountServiceAccountToken."
else
  echo "Patching ServiceAccounts to set automountServiceAccountToken=false..."
  while read -r ns name; do
    [[ -z "$ns" || -z "$name" ]] && continue
    echo "  Patching ServiceAccount: $ns/$name"
    k -n "$ns" patch serviceaccount "$name" --type=merge -p '{
      "automountServiceAccountToken": false
    }' >/dev/null
  done <<< "$sa_to_patch"
fi

echo "Verification: re-running audit for pods..."

pods_with_token_mount=$(kubectl get pods --all-namespaces -o json | jq '
  [.items[] | select(.spec.automountServiceAccountToken != false)] | length')

if [ "$pods_with_token_mount" -gt 0 ]; then
  echo "Verification FAILED: Some pods still have automountServiceAccountToken != false"
  echo "Count: $pods_with_token_mount"
  exit 1
else
  echo "Verification PASSED: All pods now have automountServiceAccountToken=false"
fi

echo "Listing ServiceAccounts that still allow token automount (if any)..."
kubectl get serviceaccounts --all-namespaces -o json | jq -r '
  .items[]
  | select(.automountServiceAccountToken != false)
  | "\(.metadata.namespace) \(.metadata.name)"' || true

echo "Automation completed."