Skip to content

Access to ServiceAccount token should be restricted #461

@paulfantom

Description

@paulfantom

What happened?

Pods which are not contacting kubernetes API have SA token mounted which is a security threat. We should consider implementing mechanisms from kube-prometheus project and prevent mounting SA token in following objects:

    Deployment - test-grafana 
    Deployment - test-promscale 
    Pod - test-grafana-test 
    ServiceAccount - test-grafana 
    ServiceAccount - test-grafana-test 
    ServiceAccount - test-prometheus-node-exporter 
    ServiceAccount - test-promscale-initializer-sa 

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions