API server pod has --service-account-lookup set to true

​

What this check verifies

Kubernetes API server has service account lookup enabled via --service-account-lookup=true, validating presented service account tokens against currently existing ServiceAccounts during authentication.

​

Risk

Without service account lookup, tokens tied to deleted or renamed ServiceAccounts can still authenticate, enabling persistence with stale credentials, unauthorized API access, and lateral movement, degrading confidentiality and integrity of cluster resources.

​

Recommendation

Enable --service-account-lookup=true so token validity depends on the ServiceAccount’s current state. Apply least privilege to ServiceAccounts, favor short-lived tokens, and promptly remove unused accounts and secrets. Combine with strict RBAC and auditing for defense in depth.

​

Remediation

Dashboard steps

1. SSH to each control plane node with root privileges
2. Edit the static Pod manifest: sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
3. In the kube-apiserver container command list, add the flag:
   --service-account-lookup=true
   
4. Save the file; the kubelet will automatically restart the API server
5. Verify the flag is active: ps aux | grep kube-apiserver | grep — —service-account-lookup=true

​

References

• https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
• https://kubernetes.io/docs/reference/access-authn-authz/authentication/#service-account-tokens

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_service_account_lookup_true. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks