Pods That Do Not Use The API Should Disable Token Automount

kubectl get pods -A \
  -o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,SA:.spec.serviceAccountName,AUTO:.spec.automountServiceAccountToken' \
  | grep -v ' true$' | grep -v ' false$' | grep -v NAMESPACE

kubectl get pod POD_NAME -n POD_NAMESPACE -o yaml > /tmp/pod-debug.yaml

kubectl patch deployment DEPLOYMENT_NAME -n POD_NAMESPACE \
  --type='strategic' \
  -p '{
    "spec": {
      "template": {
        "spec": {
          "automountServiceAccountToken": false
        }
      }
    }
  }'

apiVersion: v1
kind: Pod
metadata:
  name: example-pod
  namespace: example-namespace
spec:
  automountServiceAccountToken: false
  containers:
  - name: app
    image: your-image

kubectl apply -f path/to/pod.yaml

kubectl get pods --all-namespaces -o json | jq -r '
  [ .items[]
  | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | (.spec.automountServiceAccountToken == false) as $ok
  | "ns=\($m.namespace) name=\($m.name) automountServiceAccountToken=\(if .spec.automountServiceAccountToken == null then "unset" else .spec.automountServiceAccountToken end) is_compliant=\(if $ok then "true" else "false" end)"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

#!/usr/bin/env bash
#
# Disable automountServiceAccountToken for pods that do NOT need the Kubernetes API.
#
# IMPORTANT: This script does NOT change anything automatically.
# For each non-compliant Pod, it:
#   - Shows current Pod spec
#   - Shows owning controller (if any)
#   - Prints a kubectl patch command you can copy, review, and run
#
# This is deliberate: the benchmark specifies that pods which legitimately
# call the API must be reviewed, not blindly remediated.
#
# Run on: any machine with kubectl access to the cluster
# Requirements: bash, kubectl, jq

set -euo pipefail

echo "=== Scanning for pods with automountServiceAccountToken not explicitly set to false ==="

# Reuse the audit logic to list only non-compliant pods (outside system namespaces)
non_compliant_json="$(kubectl get pods --all-namespaces -o json | jq '
  .items[]
  | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | select(.spec.automountServiceAccountToken != false)
')"

if [[ -z "${non_compliant_json}" ]]; then
  echo "No non-compliant pods found. Cluster is compliant for this control."
  exit 0
fi

echo "Non-compliant pods detected. Listing details and suggested patches."
echo

# Iterate each offending pod
echo "${non_compliant_json}" | jq -c '.' | while read -r pod; do
  ns="$(jq -r '.metadata.namespace' <<< "${pod}")"
  name="$(jq -r '.metadata.name' <<< "${pod}")"
  sa="$(jq -r '.spec.serviceAccountName // "default"' <<< "${pod}")"
  owner_kind="$(jq -r '[.metadata.ownerReferences[]? | select(.controller)] | first.kind // "Pod"' <<< "${pod}")"
  owner_name="$(jq -r '[.metadata.ownerReferences[]? | select(.controller)] | first.name // ""' <<< "${pod}")"

  echo "-----------------------------------------------------------------"
  echo "Pod: ${ns}/${name}"
  echo "  ServiceAccount: ${sa}"
  echo "  Controller: ${owner_kind}${owner_name:+/${owner_name}}"

  if [[ "${owner_kind}" == "Pod" || -z "${owner_kind}" || "${owner_name}" == "null" ]]; then
    echo "  NOTE: This is a standalone Pod (not controlled by a higher-level workload)."
    echo "  Review whether this Pod ever calls the Kubernetes API. If it does NOT,"
    echo "  you can set automountServiceAccountToken=false directly on the Pod spec."
    echo
    echo "  Suggested patch (standalone Pod):"
    cat <<EOF
kubectl -n ${ns} patch pod ${name} --type merge -p '{
  "spec": {
    "automountServiceAccountToken": false
  }
}'
EOF
  else
    echo "  NOTE: This Pod is managed by a controller. You MUST patch the controller"
    echo "  (e.g., Deployment, StatefulSet, DaemonSet, Job, CronJob, etc.), not the Pod."
    echo "  Review whether this workload ever calls the Kubernetes API. If it does NOT,"
    echo "  you can set automountServiceAccountToken=false in the pod template."
    echo
    echo "  Suggested patch (controller template):"
    # For typical workload types we can provide a generic patch.
    # User must adjust 'spec.template.spec' path if their controller is custom.
    case "${owner_kind}" in
      Deployment|StatefulSet|DaemonSet)
        cat <<EOF
kubectl -n ${ns} patch ${owner_kind,,} ${owner_name} --type merge -p '{
  "spec": {
    "template": {
      "spec": {
        "automountServiceAccountToken": false
      }
    }
  }
}'
EOF
        ;;
      Job)
        cat <<EOF
kubectl -n ${ns} patch job ${owner_name} --type merge -p '{
  "spec": {
    "template": {
      "spec": {
        "automountServiceAccountToken": false
      }
    }
  }
}'
EOF
        ;;
      CronJob)
        cat <<EOF
kubectl -n ${ns} patch cronjob ${owner_name} --type merge -p '{
  "spec": {
    "jobTemplate": {
      "spec": {
        "template": {
          "spec": {
            "automountServiceAccountToken": false
          }
        }
      }
    }
  }
}'
EOF
        ;;
      *)
        echo "  Unrecognized or custom controller kind: ${owner_kind}"
        echo "  Inspect its spec and add automountServiceAccountToken: false under the Pod template:"
        echo "    - For most controllers, this is under .spec.template.spec"
        echo "    - For CronJob, it is under .spec.jobTemplate.spec.template.spec"
        echo
        echo "  Generic example (adjust apiVersion/kind/path as needed):"
        cat <<'EOF'
kubectl -n <namespace> patch <kind> <name> --type merge -p '{
  "spec": {
    "template": {
      "spec": {
        "automountServiceAccountToken": false
      }
    }
  }
}'
EOF
        ;;
    esac
  fi
  echo
done

echo "-----------------------------------------------------------------"
echo "Review and run the suggested kubectl patch commands ONLY for workloads"
echo "that do NOT need to call the Kubernetes API."

echo
echo "=== Verification (re-run the benchmark-style audit) ==="
kubectl get pods --all-namespaces -o json | jq -r '
  [ .items[]
  | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | (.spec.automountServiceAccountToken == false) as $ok
  | select($ok | not)
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else "Non-compliant pods remain; review above output." end'