review-security-k8s-service-accounts

To audit Kubernetes service accounts for over-privileged RBAC roles, analyze RBAC bindings and validate workload identity mappings to enforce least privilege and detect excessive permissions across cluster namespaces.

Checking Kubernetes service accounts for insecure token automounting involves evaluating token automounting settings to detect default token usage and ensure secure identity boundaries across your workloads.

The best way to enforce least privilege for Kubernetes service accounts is to validate strict 1:1 app-to-account mapping and assess RBAC configurations to prevent over-privileged identities and lateral movement risks.

You need to replace long-lived Kubernetes service account tokens during security sprints to comply with best practices, switching to ephemeral tokens generated via the TokenRequest API for secure identity boundaries.

Yes, you can use this audit to find orphaned service accounts in production namespaces by evaluating workload identity mappings and ServiceAccount configurations to detect unused or shared identities.

Kubernetes workload identity auditing detects shared identities across workloads by evaluating 1:1 app-to-account mapping and analyzing service account configurations to flag insecure identity boundaries.