Ensure Default Service Accounts Are Not Actively Used

1. Identify default service accounts and workloads using them (run on any machine with kubectl access)
   kubectl get serviceaccounts --all-namespaces \
     -o jsonpath='{range .items[?(@.metadata.name=="default")]}{.metadata.namespace}{"\n"}{end}'
   
   kubectl get pods --all-namespaces \
     -o jsonpath='{range .items[?(@.spec.serviceAccountName=="default")]}{@.metadata.namespace}{"\t"}{@.metadata.name}{"\n"}{end}'
   
2. Create explicit service accounts to replace default where needed (run on any machine with kubectl access; repeat per namespace)
   # Example: create a dedicated service account for a workload in namespace my-namespace
   kubectl create serviceaccount app-sa -n my-namespace
   
   # If workloads need specific RBAC, bind roles to the new service account, e.g.:
   kubectl create rolebinding app-sa-view \
     --clusterrole=view \
     --serviceaccount=my-namespace:app-sa \
     -n my-namespace
   
3. Update pods/workloads to stop using the default ServiceAccount (run on any machine with kubectl access; repeat per workload)
   • For Deployments, StatefulSets, DaemonSets, Jobs, etc., edit the manifest and set spec.template.spec.serviceAccountName:
   # Example for a Deployment
   kubectl -n my-namespace edit deployment my-deployment
   
   • In the editor, under spec.template.spec, add or change:
   serviceAccountName: app-sa
   
   • Save and exit to trigger a rollout using the new service account.
4. Disable token automount on each default ServiceAccount (run on any machine with kubectl access; repeat per namespace that has an active default SA)
   # Example for namespace my-namespace
   kubectl -n my-namespace patch serviceaccount default \
     -p '{"automountServiceAccountToken": false}'
   
5. Optionally enforce pod-level override for any remaining pods (run on any machine with kubectl access; repeat where needed)
   • For any pod spec that must explicitly ensure no token automount (and still uses default or no SA set), edit and set:
   kubectl -n my-namespace edit deployment my-deployment
   
   • Under spec.template.spec, add:
   automountServiceAccountToken: false
   
6. Verify remediation (run on any machine with kubectl access)
   echo "🔹 Default Service Accounts with automountServiceAccountToken enabled:"
   default_sa_count=$(kubectl get serviceaccounts --all-namespaces -o json | jq '
     [.items[] | select(.metadata.name == "default" and (.automountServiceAccountToken != false))] | length')
   if [ "$default_sa_count" -gt 0 ]; then
     echo "default_sa_not_auto_mounted"
   else
     echo "OK: all default serviceaccounts have automountServiceAccountToken=false"
   fi
   
   echo "\n🔹 Pods using default ServiceAccount:"
   pods_using_default_sa=$(kubectl get pods --all-namespaces -o json | jq '
     [.items[] | select(.spec.serviceAccountName == "default")] | length')
   if [ "$pods_using_default_sa" -gt 0 ]; then
     echo "default_sa_used_in_pods"
   else
     echo "OK: no pods are using the default serviceaccount"
   fi
   

​

Using kubectl

1. Identify default ServiceAccounts with token automount enabled
   Run on: any machine with kubectl access
   kubectl get serviceaccounts --all-namespaces -o json \
   | jq -r '.items[]
     | select(.metadata.name=="default" and (.automountServiceAccountToken != false))
     | "\(.metadata.namespace)"' \
   | sort -u
   
2. Disable token automount on each default ServiceAccount
   Replace <NAMESPACE> with each namespace from the previous command.
   Run on: any machine with kubectl access
   kubectl patch serviceaccount default \
     -n <NAMESPACE> \
     --type merge \
     -p '{"automountServiceAccountToken": false}'
   
   To apply this for all current namespaces in one go (requires bash + jq):
   for ns in $(kubectl get serviceaccounts --all-namespaces -o json \
     | jq -r '.items[]
       | select(.metadata.name=="default" and (.automountServiceAccountToken != false))
       | .metadata.namespace' | sort -u); do
     kubectl patch serviceaccount default \
       -n "$ns" \
       --type merge \
       -p '{"automountServiceAccountToken": false}'
   done
   
3. Ensure workloads do not use the default ServiceAccount
   For each deployment/statefulset/cronjob/etc. that currently uses serviceAccountName: default, update its manifest to use an explicit ServiceAccount, for example: Example ServiceAccount manifest (apply per namespace as needed):
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: my-app-sa
     namespace: my-namespace
   automountServiceAccountToken: true
   
   Example Deployment manifest snippet:
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: my-app
     namespace: my-namespace
   spec:
     template:
       spec:
         serviceAccountName: my-app-sa
   
   Apply:
   kubectl apply -f my-app-serviceaccount.yaml
   kubectl apply -f my-app-deployment.yaml
   
4. Verification
   Run on: any machine with kubectl access
   echo "🔹 Default Service Accounts with automountServiceAccountToken enabled:"
   default_sa_count=$(kubectl get serviceaccounts --all-namespaces -o json | jq '
     [.items[] | select(.metadata.name == "default" and (.automountServiceAccountToken != false))] | length')
   if [ "$default_sa_count" -gt 0 ]; then
     echo "default_sa_not_auto_mounted"
   else
     echo "OK: all default ServiceAccounts have automountServiceAccountToken=false"
   fi
   
   echo
   echo "🔹 Pods using default ServiceAccount:"
   pods_using_default_sa=$(kubectl get pods --all-namespaces -o json | jq '
     [.items[] | select(.spec.serviceAccountName == "default")] | length')
   if [ "$pods_using_default_sa" -gt 0 ]; then
     echo "default_sa_used_in_pods"
   else
     echo "OK: no pods are using the default ServiceAccount"
   fi