Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Question] How to fix the issue of control CIS-5.1.5 #165

Open
dwertent opened this issue Nov 9, 2022 · 5 comments
Open

[Question] How to fix the issue of control CIS-5.1.5 #165

dwertent opened this issue Nov 9, 2022 · 5 comments
Labels
question Further information is requested

Comments

@dwertent
Copy link

dwertent commented Nov 9, 2022

Hi, I see the namespace default failed, but Kubescape did not provide any remediation.
How can I fix the YAML so it will pass?

YAML:

apiVersion: v1
kind: Namespace
metadata:
  labels:
    app: my-namespace
    kubernetes.io/metadata.name: my-namespace
  name: my-namespace
@dwertent dwertent added the question Further information is requested label Nov 9, 2022
@YiscahLevySilas1
Copy link
Collaborator

Hi,
the control checks if there is a service account apart from "default" in every namespace and fails those that don't have one.
The remediation is to create another SA that is not "default" in this ns.

@dwertent
Copy link
Author

Thank you.
What if my application does not require a service account?
Maybe this should fail if there is only the default service account and the configuration of using default service account is set to true.

@YiscahLevySilas1
Copy link
Collaborator

Hi,
In all our controls there is always the case where the misconfiguration we're looking for is intentional. That is what the exceptions are for. In this case - it is more a need to review each namespace rather than fail them automatically. In the future we will have a control status which should represent that better.

As to your suggestion - do you mean checking the automountServiceAccountToken field? That is indeed checked in this control in the default Service Accounts.

@YiscahLevySilas1
Copy link
Collaborator

Looking back at the remediation procedure of this CIS control, I am thinking maybe we should fail workloads that use the default SA, and not the namespaces. (And in the future - change fail to status "to be reviewed")
What do you think?
@shm12 - thoughts?

@dwertent
Copy link
Author

@YiscahLevySilas1 any updates here?

@matthyx matthyx moved this to Triage in Kubescaping Aug 18, 2024
@matthyx matthyx moved this from Triage to Accepted in Kubescaping Sep 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question Further information is requested
Projects
Status: Accepted
Development

No branches or pull requests

2 participants