Investigate the automatic mapping of service accounts

[philipgough]

What is missing?

In #1584 we introduced security scanning of our manifests via kubescape.

The output of that scan shows following resources have enabled automatic mapping of their service account tokens

• ServiceAccount - alertmanager-main
• ServiceAccount - blackbox-exporter
• ServiceAccount - grafana
• ServiceAccount - kube-state-metrics
• ServiceAccount - node-exporter
• ServiceAccount - prometheus-k8s
• ServiceAccount - prometheus-adapter
• ServiceAccount - prometheus-operator
• Deployment - blackbox-exporter
• Deployment - grafana
• Deployment - kube-state-metrics
• Deployment - prometheus-adapter
• Deployment - prometheus-operator
• DaemonSet - node-exporter

We should investigate in all listed cases if we can disable this default setting, enabling it only for PODS that need them. If we can not make the change, we should document why and add an exception to our configuration.

After we make the changes, we should determine the new risk score and adjust the threshold accordingly

Why do we need it?

Description: Potential attacker may gain access to a POD and steal its service account token. Therefore, it is recommended to disable automatic mapping of the service account tokens in service account configuration and enable it only for PODs that need to use them.

See https://hub.armo.cloud/docs/c-0034

cc @ArthurSens

[paulfantom]

I completely forgot to finish this after the investigation I did in my homelab. 🤦 Sorry.

The result was that after setting automountServiceAccountToken to false in all ServiceAccount objects only the following components needed to have this reenabled on pod level:

• prometheus
• prometheus-operator
• kube-state-metrics
• prometheus-adapter

Those 4 components need environment variables set with automountServiceAccountToken: true to connect to kubernetes API server.

Bear in mind that to do this properly we need to modify code in 4 different repositories (specific files listed below):

• prometheus-operator
• kube-state-metrics
• kubernetes-grafana
• here ;)

[philipgough]

Closed via #1591

[werdnum]

See #1808 - this change has broken the scraper in my installation.