diff --git a/iac-extensions/arm/sonarpedia.json b/iac-extensions/arm/sonarpedia.json index af2578e34..935f07be5 100644 --- a/iac-extensions/arm/sonarpedia.json +++ b/iac-extensions/arm/sonarpedia.json @@ -3,7 +3,7 @@ "languages": [ "AZURE_RESOURCE_MANAGER" ], - "latest-update": "2024-08-16T07:50:07.534405Z", + "latest-update": "2024-09-02T14:46:42.140530Z", "options": { "no-language-in-filenames": true, "preserve-filenames": true diff --git a/iac-extensions/cloudformation/sonarpedia.json b/iac-extensions/cloudformation/sonarpedia.json index a6f1c8eff..21378c23d 100644 --- a/iac-extensions/cloudformation/sonarpedia.json +++ b/iac-extensions/cloudformation/sonarpedia.json @@ -3,7 +3,7 @@ "languages": [ "CLOUD_FORMATION" ], - "latest-update": "2024-08-16T07:50:15.493939Z", + "latest-update": "2024-09-02T14:46:49.511642Z", "options": { "no-language-in-filenames": true, "preserve-filenames": true diff --git a/iac-extensions/docker/sonarpedia.json b/iac-extensions/docker/sonarpedia.json index 325cbb5ca..ab2169aa6 100644 --- a/iac-extensions/docker/sonarpedia.json +++ b/iac-extensions/docker/sonarpedia.json @@ -3,7 +3,7 @@ "languages": [ "DOCKER" ], - "latest-update": "2024-08-16T07:50:23.559218Z", + "latest-update": "2024-09-02T14:46:56.877054Z", "options": { "no-language-in-filenames": true, "preserve-filenames": true diff --git a/iac-extensions/kubernetes/sonarpedia.json b/iac-extensions/kubernetes/sonarpedia.json index 011cd7bdf..821d05c15 100644 --- a/iac-extensions/kubernetes/sonarpedia.json +++ b/iac-extensions/kubernetes/sonarpedia.json @@ -3,7 +3,7 @@ "languages": [ "KUBERNETES" ], - "latest-update": "2024-08-16T07:50:30.957934Z", + "latest-update": "2024-09-02T14:47:03.763797Z", "options": { "no-language-in-filenames": true, "preserve-filenames": true diff --git a/iac-extensions/kubernetes/src/main/resources/org/sonar/l10n/kubernetes/rules/kubernetes/S6865.html b/iac-extensions/kubernetes/src/main/resources/org/sonar/l10n/kubernetes/rules/kubernetes/S6865.html index 0341521b9..e56295eae 100644 --- a/iac-extensions/kubernetes/src/main/resources/org/sonar/l10n/kubernetes/rules/kubernetes/S6865.html +++ b/iac-extensions/kubernetes/src/main/resources/org/sonar/l10n/kubernetes/rules/kubernetes/S6865.html @@ -1,10 +1,8 @@

Why is this an issue?

-

Service account tokens are Kubernetes secrets created automatically to authenticate applications running inside pods to the API server. If a pod is -compromised, an attacker could use this token to gain access to other resources in the cluster.

+

Service account tokens are Kubernetes secrets to authenticate applications running inside pods to the API server. If a pod is compromised, an +attacker could use this token to gain access to other resources in the cluster.

For example, they could create new pods, modify existing ones, or even delete critical system pods, depending on the permissions associated with the service account.

-

Therefore, it’s recommended to disable the automounting of service account tokens when it’s not necessary for the application running in the -pod.

What is the potential impact?

Unauthorized Access

If a pod with a mounted service account gets compromised, an attacker could potentially use the token to interact with the Kubernetes API, possibly @@ -21,6 +19,8 @@

Denial of Service

How to fix it

Code examples

Noncompliant code example

+

In this example, the service account token is mounted in the pod example-pod by default, but is unnecessary for the pod and its +service(s) to function correctly.

 apiVersion: v1
 kind: Pod
@@ -28,8 +28,21 @@ 
Noncompliant code example

   name: example-pod
 spec: # Noncompliant
   containers:
-  - name: example-pod
-    image: nginx:1.25.3
+  - name: example-container
+    image: nginx
+
+

In this example, the service account token is mounted in the pod example-pod and is necessary, for example because it allows a +third-party service to authenticate with the Kubernetes API. However, no specific permissions are granted to the service account:

+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: example-pod
+spec:
+  serviceAccountName: example-sa # Noncompliant
+  containers:
+  - name: example-container
+    image: nginx

Compliant solution

@@ -39,13 +52,68 @@ 
Compliant solution

   name: example-pod
 spec:
   containers:
-  - name: example-pod
-    image: nginx:1.25.3
+  - name: example-container
+    image: nginx
   automountServiceAccountToken: false
+

In the following example, Role bindings are created, but Cluster Role Bindings would be more appropriate if the service account is intended to be +used across multiple namespaces:

+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: example-sa
+  namespace: default
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: default
+  name: example-role
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["list"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: example-role-binding
+  namespace: default
+subjects:
+- kind: ServiceAccount
+  name: example-sa
+  namespace: default
+roleRef:
+  kind: Role
+  name: example-role
+  apiGroup: rbac.authorization.k8s.io
+
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: example-pod
+  namespace: default
+spec:
+  serviceAccountName: example-sa
+  containers:
+  - name: example-container
+    image: nginx
+

How does this work?

-

The automounting of service account tokens can be disabled by setting automountServiceAccountToken: false in the pod’s specification. -Additionally, it can be disabled in the configuration of an accompanied service account.

+

The essential part of the solution is to make sure that permissions within the cluster are constructed in a way that minimizes the risk of +unauthorized access.

+

To do so, it follows a least-privilege approach.

+
    +
  1. If the service account token is unnecessary for the pod to function, disable automounting.
    2. +
  2. If the service account token is required, ensure that the service account has the least amount of permissions necessary to perform its + function.
    3. +
+

Additionally, service account token automounting can be disabled directly from the service account specification file.

Resources

Documentation