Pods That Do Not Use The API Should Disable Token Automount

kubectl -n app-namespace get deploy web -o yaml > web-deploy.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  namespace: app-namespace
spec:
  template:
    spec:
      automountServiceAccountToken: false
      # ... other fields remain unchanged

kubectl apply -f web-deploy.yaml

kubectl -n app-namespace get pod web-standalone -o yaml > web-standalone-pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: web-standalone
  namespace: app-namespace
spec:
  automountServiceAccountToken: false
  # ... other fields remain unchanged

kubectl -n app-namespace delete pod web-standalone
kubectl apply -f web-standalone-pod.yaml

kubectl -n app-namespace get serviceaccount web-sa -o yaml > web-sa.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: web-sa
  namespace: app-namespace
automountServiceAccountToken: false

kubectl apply -f web-sa.yaml

kubectl get pods --all-namespaces -o json | jq -r '
  [ .items[]
  | select(.metadata.namespace as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | (.spec.nodeName // "") as $node
  | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
  | ([ ($m.ownerReferences // [])[] | select(.controller) ] | first) as $own
  | (.spec.automountServiceAccountToken == false) as $ok
  | "kind=Pod ns=\($m.namespace) name=\($m.name) uid=\($m.uid) apiVersion=v1"
    + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
    + (if $node   == ""   then "" else " node=\($node)" end)
    + (if $labels == ""   then "" else " labels=\($labels)" end)
    + (if $own    == null then "" else " owner=\($own.kind)/\($m.namespace)/\($own.name)/\($own.uid)" end)
    + " serviceAccount=\(.spec.serviceAccountName // "default")"
    + " automountServiceAccountToken=\(if .spec.automountServiceAccountToken == null then "unset" else .spec.automountServiceAccountToken end)"
    + " is_compliant=\(if $ok then "true" else "false" end)"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

#!/usr/bin/env bash
#
# Disable automountServiceAccountToken for pods in OKE that do NOT need
# the Kubernetes API, by defaulting to a secure ServiceAccount setting.
#
# RUN ON: any machine with kubectl access and jq installed.
#
# NOTES:
# - This script does NOT try to guess which pods use the API.
# - It only operates on namespaces you explicitly approve.
# - It configures the *ServiceAccount* used by pods:
#     automountServiceAccountToken: false
#   so new pods using that SA will not auto-mount tokens.
# - Existing running pods will keep their current mounts until restarted.

set -euo pipefail

# ---------- CONFIGURATION ----------

# Comma-separated list of namespaces you have reviewed and decided that
# workloads there do NOT need to call the Kubernetes API.
# Example: SAFE_NAMESPACES="dev,test,frontend"
SAFE_NAMESPACES="${SAFE_NAMESPACES:-}"

if [[ -z "${SAFE_NAMESPACES}" ]]; then
  echo "ERROR: SAFE_NAMESPACES is empty."
  echo "Set SAFE_NAMESPACES to a comma-separated list of non-system namespaces"
  echo "whose pods you have reviewed and determined do NOT need the Kubernetes API."
  echo "Example:"
  echo "  SAFE_NAMESPACES='dev,test,frontend' $0"
  exit 1
fi

# Convert SAFE_NAMESPACES to an array
IFS=',' read -r -a NS_LIST <<< "${SAFE_NAMESPACES}"

# Namespaces that must always be excluded
EXCLUDED_NS_REGEX='^(kube-system|kube-public|kube-node-lease)$'

echo "Using SAFE_NAMESPACES: ${SAFE_NAMESPACES}"
echo

# ---------- FUNCTIONS ----------

ensure_namespace_allowed() {
  local ns="$1"
  if [[ "${ns}" =~ ${EXCLUDED_NS_REGEX} ]]; then
    return 1
  fi
  return 0
}

# Patch or create ServiceAccounts with automountServiceAccountToken: false
harden_service_accounts_in_namespace() {
  local ns="$1"

  if ! ensure_namespace_allowed "${ns}"; then
    echo "Skipping system namespace: ${ns}"
    return
  fi

  echo "Processing namespace: ${ns}"

  # Get all ServiceAccounts in the namespace (including 'default')
  local sa_list
  if ! sa_list=$(kubectl get sa -n "${ns}" -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null); then
    echo "  WARNING: Failed to list ServiceAccounts in namespace ${ns}, skipping."
    return
  fi

  if [[ -z "${sa_list}" ]]; then
    echo "  No ServiceAccounts found in namespace ${ns}."
    return
  fi

  while IFS= read -r sa; do
    [[ -z "${sa}" ]] && continue

    # Check current value (may be null/unset)
    local current
    current=$(kubectl get sa "${sa}" -n "${ns}" -o jsonpath='{.automountServiceAccountToken}' 2>/dev/null || echo "")

    if [[ "${current}" == "false" ]]; then
      echo "  SA ${ns}/${sa}: automountServiceAccountToken already false"
      continue
    fi

    echo "  Patching SA ${ns}/${sa}: setting automountServiceAccountToken=false"
    kubectl patch sa "${sa}" -n "${ns}" \
      --type merge \
      -p '{"automountServiceAccountToken": false}' >/dev/null
  done <<< "${sa_list}"
}

# Verify by re-running a focused version of the audit logic
verify_namespace() {
  local ns="$1"

  echo
  echo "Verification for namespace: ${ns}"

  kubectl get pods -n "${ns}" -o json | jq -r '
    [ .items[]
    | .metadata as $m
    | (.spec.automountServiceAccountToken == false) as $ok
    | "kind=Pod ns=\($m.namespace) name=\($m.name) " +
      "serviceAccount=\(.spec.serviceAccountName // "default") " +
      "automountServiceAccountToken=\(if .spec.automountServiceAccountToken == null then "unset" else .spec.automountServiceAccountToken end) " +
      "is_compliant=\(if $ok then "true" else "false" end)"
    ] as $rows
    | if ($rows | length) == 0 then "no_pods_in_namespace" else $rows[] end'
}

# ---------- MAIN ----------

for ns in "${NS_LIST[@]}"; do
  ns_trimmed="$(echo "${ns}" | xargs)"
  [[ -z "${ns_trimmed}" ]] && continue

  if ! kubectl get ns "${ns_trimmed}" >/dev/null 2>&1; then
    echo "Namespace ${ns_trimmed} not found; skipping."
    continue
  fi

  harden_service_accounts_in_namespace "${ns_trimmed}"
  verify_namespace "${ns_trimmed}"
done

echo
echo "Completed. For cluster-wide verification, run:"
echo "  kubectl get pods --all-namespaces -o json | jq -r '...<full audit expression>...'"