More Info:
Service accounts tokens should not be mounted in pods except where the workload running in the pod explicitly needs to communicate with the API serverRisk Level
MediumAddress
SecurityCompliance Standards
- CIS Kubernetes
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
Review pod and service account objects in the cluster and ensure that the option belowis set, unless the resource explicitly requires this access.automountServiceAccountToken: false