ServiceAccount

RESOURCE

An identity for processes running inside Pods to authenticate with the API server

Kind
ServiceAccount
Type
RESOURCE
Referenced by
20 topics

A ServiceAccount provides an identity for processes running in a Pod. When a Pod needs to talk to the Kubernetes API, it uses the ServiceAccount’s token to authenticate. Every namespace has a default ServiceAccount, and every Pod gets one assigned automatically if you don’t specify otherwise.

The token gets mounted into the Pod at /var/run/secrets/kubernetes.io/serviceaccount/. From a security perspective, you should avoid using the default ServiceAccount for workloads that need API access. Create dedicated ones with only the RBAC permissions they actually need. You can also disable token auto-mounting for Pods that don’t need API access at all.

Attacked and defended in

20
OFFENSIVE Abusing Kubernetes API Server Proxy LATERAL MOVEMENT OFFENSIVE Compromising ArgoCD via Application Sync PRIVILEGE ESCALATION OFFENSIVE Compromising etcd via Pod Creation CREDENTIAL ACCESS OFFENSIVE Data Exfiltration via Kubernetes Events EXFILTRATION DEFENSIVE Detecting API Server Proxy Abuse DEFENSIVE Detecting Argo Workflows Abuse via Audit Logs DEFENSIVE Detecting Data Exfiltration via Kubernetes Events DEFENSIVE Detecting Impersonation Abuse DEFENSIVE Detecting Orphan Pod Masquerading via Audit Logs DEFENSIVE Detecting Permission Enumeration via Audit Logs DEFENSIVE Disable Automatic Mounting of Default Service Account Tokens OFFENSIVE Kubernetes Impersonation PRIVILEGE ESCALATION OFFENSIVE Persistence via Unbound Service Account Tokens PERSISTENCE OFFENSIVE Privilege Escalation via serviceaccounts/token Permission PRIVILEGE ESCALATION DEFENSIVE Restricting Prometheus Endpoint Access OFFENSIVE Secret Exfiltration via ApplicationSet Generators CREDENTIAL ACCESS DEFENSIVE Securing ArgoCD Application Access OFFENSIVE ServiceAccount Token Theft CREDENTIAL ACCESS OFFENSIVE Weaponizing Argo Workflows PRIVILEGE ESCALATION OFFENSIVE Weaponizing ArgoCD Application PRIVILEGE ESCALATION