Best practices

K8S API server configuration not using a separate key file for service account

Risk Level

Informational (4)

Platform(s)

  • N/A

Compliance Frameworks

Description

By default, if no --service-account-key-file is specified to the apiserver, it uses the private key from the TLS serving certificate to verify service account tokens. To ensure that the keys for service account tokens could be rotated as needed, a separate public/private key pair should be used for signing service account tokens. Hence, the public key should be specified to the apiserver with --service-account-key-file.

  • Recommended Mitigation

    It is recommended to set the '--service-account-key-file' parameter in the configuration file to a valid certificate.

Need help?

Get a free Security Risk Assessment. Start today

See Orca in action See Orca in action-> View a 10 minute recorded demo or sign up for a personalized one-on-one walk-through.