Ensure that the service-account-lookup argument is set to true
An XCCDF Rule
Description
Validate service account before validating token.
warning alert: Warning
This rule's check operates on the cluster configuration dump.
Therefore, you need to use a tool that can query the OCP API, retrieve the following:
-
{{if ne .hypershift_cluster "None"}}/api/v1/namespaces/{{.hypershift_namespace_prefix}}-{{.hypershift_cluster}}/configmaps/kas-config{{else}}/api/v1/namespaces/openshift-kube-apiserver/configmaps/config{{end}}API endpoint, filter with with thejqutility using the following filter{{if ne .hypershift_cluster "None"}}.data."config.json" | fromjson{{else}}.data."config.yaml" | fromjson{{end}}and persist it to the local
Rationale
If service-account-lookup is not enabled, the apiserver
only verifies that the authentication token is valid, and
does not validate that the service account token mentioned
in the request is actually present in etcd. This allows
using a service account token even after the corresponding
service account is deleted. This is an example of time of
check to time of use security issue.
- ID
- xccdf_org.ssgproject.content_rule_api_server_service_account_lookup
- Severity
- Medium
- References
- Updated