> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API Server Service Account Lookup Should Be True

### More Info:

Verifies that --service-account-lookup is set to true so service account tokens are validated against etcd, ensuring deleted tokens are rejected.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, open the API server static pod manifest for editing:

           ```bash theme={null}
           sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
           ```

        2. In the `command:` or `args:` list for `kube-apiserver`, either:
           * Add the flag if missing:

             ```yaml theme={null}
             - --service-account-lookup=true
             ```

           * Or, if a line like this exists, change it to `true`:

             ```yaml theme={null}
             - --service-account-lookup=false
             ```

           * Alternatively, you may delete the entire `- --service-account-lookup=...` line to rely on the secure default.

        3. Save the file and exit the editor. The kubelet will automatically detect the manifest change and restart the `kube-apiserver` static pod on that control plane node.

        4. Wait 30–60 seconds for the API server pod to restart, then verify the process on that node includes the correct flag (or that the flag is absent, using the default):

           ```bash theme={null}
           /bin/ps -ef | grep kube-apiserver | grep -v grep
           ```

        5. In the output, confirm either:
           * `--service-account-lookup=true` is present in the command line, **or**
           * there is no `--service-account-lookup=` flag at all.
      </Accordion>

      <Accordion title="Using kubectl">
        `kubectl` cannot modify the API server’s static pod manifest or its process flags. This setting must be changed directly on each control plane node in `/etc/kubernetes/manifests/kube-apiserver.yaml`; see the Manual Steps section for the required host-level changes.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediation for CIS Kubernetes 1.2.21:
        # Ensure --service-account-lookup is set to true for kube-apiserver
        #
        # Run on: every control plane node
        # Requirements: bash, grep, sed, awk, docker or crictl (or none; only for live check)
        #
        # This script:
        # 1. Backs up /etc/kubernetes/manifests/kube-apiserver.yaml
        # 2. Ensures --service-account-lookup=true is present exactly once
        # 3. Relies on the static pod mechanism to restart kube-apiserver
        # 4. Verifies the running kube-apiserver process flags

        set -euo pipefail

        MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
        BACKUP_DIR="/etc/kubernetes/manifests/backup-cis-1.2.21"
        TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

        echo "[INFO] CIS 1.2.21 remediation starting"

        if [ ! -f "$MANIFEST" ]; then
          echo "[ERROR] Manifest $MANIFEST not found on this node; is this a control plane node?"
          exit 1
        fi

        mkdir -p "$BACKUP_DIR"

        BACKUP_FILE="${BACKUP_DIR}/kube-apiserver.yaml.${TIMESTAMP}"
        cp -p "$MANIFEST" "$BACKUP_FILE"
        echo "[INFO] Backup created at $BACKUP_FILE"

        # Check current state in manifest
        if grep -qE '^\s*-?\s*--service-account-lookup(=|$)' "$MANIFEST"; then
          echo "[INFO] Existing --service-account-lookup flag found in manifest; normalizing to true"

          # Normalize any existing occurrences to --service-account-lookup=true
          # Handles both "--service-account-lookup" and "--service-account-lookup=false/true"
          tmpfile="$(mktemp)"
          awk '
            {
              gsub(/--service-account-lookup(=true|=false)?/, "--service-account-lookup=true")
              print
            }
          ' "$MANIFEST" > "$tmpfile"
          mv "$tmpfile" "$MANIFEST"
        else
          echo "[INFO] No --service-account-lookup flag found; adding --service-account-lookup=true"

          # Insert flag in the command list under containers[].command
          # Heuristic: append as a new "- --service-account-lookup=true" line
          # after the last existing kube-apiserver flag line.
          tmpfile="$(mktemp)"
          inserted=0

          while IFS= read -r line; do
            echo "$line" >> "$tmpfile"
            # Detect likely flag lines (indented "- --something")
            if [[ "$line" =~ ^[[:space:]]*-[[:space:]]*--[a-zA-Z0-9-]+=?.* ]]; then
              last_flag_line="$line"
            fi
          done < "$MANIFEST"

          if [ -n "${last_flag_line:-}" ]; then
            # Rebuild with insertion after the last flag line
            : > "$tmpfile"
            while IFS= read -r line; do
              echo "$line" >> "$tmpfile"
              if [ "$line" = "$last_flag_line" ] && [ "$inserted" -eq 0 ]; then
                # Preserve indentation from last_flag_line
                indent="$(printf '%s\n' "$last_flag_line" | sed -E 's/^([[:space:]]*).*/\1/')"
                echo "${indent}- --service-account-lookup=true" >> "$tmpfile"
                inserted=1
              fi
            done < "$MANIFEST"
            mv "$tmpfile" "$MANIFEST"
          else
            echo "[WARN] Could not auto-locate flag section; appending at end of file"
            echo "  - --service-account-lookup=true" >> "$MANIFEST"
            rm -f "$tmpfile"
          fi
        fi

        echo "[INFO] Updated $MANIFEST. Static pod kube-apiserver will restart automatically."

        echo "[INFO] Waiting for kube-apiserver to restart with new flags..."
        # Wait up to 120s for process with updated flag
        end=$((SECONDS + 120))
        success=0

        while [ $SECONDS -lt $end ]; do
          # shellcheck disable=SC2009
          if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--service-account-lookup=true"; then
            success=1
            break
          fi
          sleep 5
        done

        if [ "$success" -ne 1 ]; then
          echo "[ERROR] kube-apiserver process did not show --service-account-lookup=true within timeout."
          echo "[INFO] Current kube-apiserver processes:"
          /bin/ps -ef | grep kube-apiserver | grep -v grep || true
          exit 2
        fi

        echo "[INFO] Verification succeeded: kube-apiserver running with --service-account-lookup=true"
        echo "[INFO] CIS 1.2.21 remediation completed successfully"
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>