Check ID: controllermanager_service_account_credentials
Provider: Kubernetes
Service: controllermanager
Severity: HIGH
Categories: cluster-security, identity-access
Resource type: Pod

​
What this check verifies

Evaluates whether the Kubernetes controller manager uses per-controller service account credentials via --use-service-account-credentials=true, meaning each controller runs with its own identity rather than a shared credential.

​
Risk

Without per-controller credentials, one token can grant broad controller privileges. Compromise or misuse enables unauthorized state changes, data exposure, and lateral movement, while reducing audit granularity-impacting confidentiality and integrity.

​
Recommendation

Enable --use-service-account-credentials=true and enforce least privilege: assign a dedicated service account per controller with minimal RBAC, limit token scope/lifetime, and monitor controller actions. This upholds separation of duties and defense in depth.

​
Remediation

Dashboard steps
  1. SSH to each control-plane node
  2. Edit the static Pod manifest: /etc/kubernetes/manifests/kube-controller-manager.yaml
  3. Under spec.containers[0].command, add a new item: —use-service-account-credentials=true
  4. Save the file; the kubelet will automatically restart the controller-manager

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = controllermanager_service_account_credentials. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks