Check ID: controllermanager_service_account_private_key_file
Provider: Kubernetes
Service: controllermanager
Severity: HIGH
Categories: cluster-security, secrets
Resource type: Pod

​
What this check verifies

Kubernetes controller manager uses a service account signing key configured via --service-account-private-key-file. The evaluation identifies whether this argument is present, indicating the component can sign service account tokens.

​
Risk

Without a configured signing key, the token controller can’t mint service account tokens, breaking pod-to-API auth and controller operations (availability). Inability to rotate keys prolongs validity of stolen or stale tokens, weakening integrity and confidentiality.

​
Recommendation

Set a dedicated signing key using --service-account-private-key-file, or adopt an approved external signer. Apply least privilege to key access, enforce regular rotation and rollover, separate signing/verification duties, and prefer short-lived tokens with strict RBAC.

​
Remediation

Dashboard steps
  1. SSH to the control plane node
  2. Edit /etc/kubernetes/manifests/kube-controller-manager.yaml
  3. Under containers[].command, add: - —service-account-private-key-file=/etc/kubernetes/pki/sa.key
  4. Save the file; the kubelet will restart the kube-controller-manager pod automatically

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = controllermanager_service_account_private_key_file. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks