> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Ensure Use Service Account Credentials Argument Is Enabled ### More Info: Use individual service account credentials for each controller ### Risk Level High ### Address Security ### Compliance Standards * CIS Kubernetes ### Triage and Remediation ### Remediation 1. On every control plane node, back up the current manifest: ```bash theme={null} sudo cp -a /etc/kubernetes/manifests/kube-controller-manager.yaml /etc/kubernetes/manifests/kube-controller-manager.yaml.bak ``` 2. Edit the controller manager manifest on that control plane node: ```bash theme={null} sudo vi /etc/kubernetes/manifests/kube-controller-manager.yaml ``` 3. In the `spec.containers[0].command` (or `args`) list, add or update the flag so it appears exactly as: ```yaml theme={null} - --use-service-account-credentials=true ``` If a line with `--use-service-account-credentials=` already exists, change its value to `true` instead of adding a duplicate. 4. Save the file and exit the editor. The kubelet on that control plane node will automatically detect the manifest change and restart the `kube-controller-manager` static pod; expect a brief controller-manager restart. 5. After 30–60 seconds, verify the new flag is in effect on that control plane node: ```bash theme={null} /bin/ps -ef | grep kube-controller-manager | grep -v grep ``` Confirm the `kube-controller-manager` process command line includes: ```text theme={null} --use-service-account-credentials=true ``` kubectl cannot modify the kube-controller-manager static pod manifest or its process flags. This finding must be remediated by editing `/etc/kubernetes/manifests/kube-controller-manager.yaml` directly on every control plane node; see the Manual Steps section for exact instructions. ```bash theme={null} #!/usr/bin/env bash # # Remediation: Ensure --use-service-account-credentials=true for kube-controller-manager # Scope: Run on every control plane node # Effect: Editing /etc/kubernetes/manifests/kube-controller-manager.yaml will # trigger an automatic restart of the kube-controller-manager static pod. # set -euo pipefail MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml" REQUIRED_ARG="--use-service-account-credentials=true" echo "[INFO] Starting remediation for kube-controller-manager on host: $(hostname)" if [[ ! -f "${MANIFEST}" ]]; then echo "[ERROR] Manifest not found: ${MANIFEST}" exit 1 fi # Backup manifest once per run (idempotent-safe because we timestamp) BACKUP="${MANIFEST}.$(date +%Y%m%d%H%M%S).bak" cp "${MANIFEST}" "${BACKUP}" echo "[INFO] Backup created at ${BACKUP}" # Check if argument already present with correct value if grep -qE '[[:space:]]-'"${REQUIRED_ARG}" "${MANIFEST}"; then echo "[INFO] Required argument already present: ${REQUIRED_ARG}" else echo "[INFO] Updating ${MANIFEST} to ensure ${REQUIRED_ARG} is set" # If any existing --use-service-account-credentials argument exists, remove it # to avoid duplicates and ensure the value is true. if grep -q -- "--use-service-account-credentials=" "${MANIFEST}"; then # Remove any line containing the flag; safe as long as used only once in args list tmpfile="$(mktemp)" sed '/--use-service-account-credentials=/d' "${MANIFEST}" > "${tmpfile}" mv "${tmpfile}" "${MANIFEST}" echo "[INFO] Removed existing --use-service-account-credentials lines" fi # Insert the required arg in the args list under kube-controller-manager container. # This assumes a standard kubeadm-style static pod manifest with 'containers:' and 'name: kube-controller-manager'. tmpfile="$(mktemp)" awk -v arg="${REQUIRED_ARG}" ' $0 ~ /name:[[:space:]]*kube-controller-manager/ { in_kcm=1 } in_kcm && $0 ~ /^[[:space:]]*args:[[:space:]]*$/ { in_args=1 } in_kcm && in_args && $0 !~ /^[[:space:]]*-[[:space:]]/ && $0 !~ /^[[:space:]]*#/ && $0 !~ /^[[:space:]]*$/ { in_args=0 } { print $0 if (in_kcm && in_args && $0 ~ /^[[:space:]]*args:[[:space:]]*$/) { print " - " arg } } ' "${MANIFEST}" > "${tmpfile}" # If awk failed to add the argument (e.g. non-standard manifest), fall back to simple append if ! grep -qE '[[:space:]]-'"${REQUIRED_ARG}" "${tmpfile}"; then echo "[WARN] Could not locate standard args section; appending argument under containers section" awk -v arg="${REQUIRED_ARG}" ' $0 ~ /name:[[:space:]]*kube-controller-manager/ { in_kcm=1 } in_kcm && $0 ~ /^[[:space:]]*image:[[:space:]]*/ && !printed { print $0 print " args:" print " - " arg printed=1 next } { print $0 } ' "${MANIFEST}" > "${tmpfile}" fi mv "${tmpfile}" "${MANIFEST}" echo "[INFO] Manifest updated. kube-controller-manager static pod will restart automatically." fi # Verification: wait for kube-controller-manager process to expose the flag echo "[INFO] Verifying kube-controller-manager process has ${REQUIRED_ARG} enabled" # Give kubelet some time to restart the static pod if it changed sleep 10 if /bin/ps -ef | grep kube-controller-manager | grep -v grep | grep -q -- "${REQUIRED_ARG}"; then echo "[SUCCESS] kube-controller-manager is running with ${REQUIRED_ARG}" exit 0 else echo "[ERROR] kube-controller-manager process is not running with ${REQUIRED_ARG}" echo "[INFO] Current kube-controller-manager processes:" /bin/ps -ef | grep kube-controller-manager | grep -v grep || true exit 2 fi ``` **Usage (run on every control plane node):** ```bash theme={null} chmod +x ./fix-use-service-account-credentials.sh sudo ./fix-use-service-account-credentials.sh ``` ### Additional Reading: * [https://github.com/kubernetes/kubernetes/blob/release-1.6/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml](https://github.com/kubernetes/kubernetes/blob/release-1.6/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml)