API server enables the ServiceAccount admission plugin

​

What this check verifies

Kubernetes API server includes the ServiceAccount admission controller (ServiceAccount)-enabled via --enable-admission-plugins and not listed in --disable-admission-plugins. It applies service account-related defaults and policies to Pods, such as assigning a service account and governing secret references.

​

Risk

Without ServiceAccount admission, Pods may reference unintended secrets and run with unpredictable identities. This enables token misuse and unauthorized API access, facilitating lateral movement and privilege abuse, degrading confidentiality and integrity of cluster resources.

​

Recommendation

Enable and keep the ServiceAccount admission controller active to enforce identity and secret policies.

• Apply least privilege: restrict secrets on each service account
• Disable token automount where not needed (automountServiceAccountToken=false)
• Isolate secrets by namespace and rotate tokens
• Keep the API server patched

​

Remediation

Dashboard steps

1. SSH to each control plane node
2. Edit the API server static pod manifest: sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
3. In the kube-apiserver container flags, add or update the line:
   • —enable-admission-plugins=ServiceAccount <!— Critical: ensures ServiceAccount plugin is enabled —>
4. If a —disable-admission-plugins flag exists, ensure ServiceAccount is NOT listed (remove it if present) <!— Critical: prevents disabling the plugin —>
5. Save the file; the kubelet will restart the API server automatically

​

References

• https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#serviceaccount

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_service_account_plugin. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks