Check ID: apiserver_service_account_key_file_set
Provider: Kubernetes
Service: apiserver
Severity: HIGH
Categories: cluster-security, identity-access
Resource type: Pod

​
What this check verifies

Kubernetes API server uses --service-account-key-file to supply the public key(s) for validating service account tokens. Detection looks for API server containers that lack this flag.

​
Risk

Without a dedicated key file, token validation can fall back to the API server’s TLS key, eroding separation of duties. Compromise or rotation of that key can enable token forgery (confidentiality/integrity) or invalidate tokens, disrupting workloads (availability).

​
Recommendation

Use a dedicated key pair for service accounts:
  • Configure --service-account-key-file with public keys for validation
  • Keep signing and serving keys separate (least privilege)
  • Enforce scheduled key rotation and maintain multiple active keys for defense in depth

​
Remediation

Dashboard steps
  1. SSH to the control plane node.
  2. Edit the API server static pod manifest: sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
  3. In spec.containers[0].command add this line: 
    - --service-account-key-file=/etc/kubernetes/pki/sa.pub
  4. Save the file; the kubelet will restart the API server automatically.

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_service_account_key_file_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks