Best practices

K8S API server configuration not using a separate key file for service account

Risk Level

Informational (4)

  • N/A


By default, if no --service-account-key-file is specified to the apiserver, it uses the private key from the TLS serving certificate to verify service account tokens. To ensure that the keys for service account tokens could be rotated as needed, a separate public/private key pair should be used for signing service account tokens. Hence, the public key should be specified to the apiserver with --service-account-key-file.
  • Recommended Mitigation

    It is recommended to set the '--service-account-key-file' parameter in the configuration file to a valid certificate.