XEIZE
/Vulnerability documentation/IaC/Kubernetes/ServiceAccount name not specified

ServiceAccount name not specified

A missing or empty serviceAccountName uses the namespace’s default ServiceAccount, which may have unintended permissions.

Description

When a Pod’s serviceAccountName is missing or empty, Kubernetes uses the default ServiceAccount in the same namespace. Depending on that account’s bindings, it may allow unintended API access. Merely specifying a name does not reduce permissions.

Service accounts help define a workload’s API access. Manage the account and its least-privilege permissions together for each workload purpose.

Potential impact

  • Workloads may unexpectedly receive the default account’s permissions.
  • Separating permissions between workloads can become harder.
  • Requests from different workloads using the same default account can be harder to distinguish.

Remediation

  • Set serviceAccountName explicitly on Pods.
  • Review templates and manifests for unintended empty or omitted values.
  • Create dedicated ServiceAccounts for applications and grant only the required permissions.

Examples

Replace the illustrative images with the images you intend to use. Create the build-robot ServiceAccount separately in the Pod’s namespace and grant only the required permissions.

Before

yaml
apiVersion: v1
kind: Pod
metadata:
  name: nginx3
spec:
  containers:
    - image: nginx3
      name: nginx3
  serviceAccountName: ""

After

yaml
apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
    - image: nginx
      name: nginx
  serviceAccountName: build-robot

Explanation:

  • Before: An empty ServiceAccount name uses the default account.
  • After: An explicit ServiceAccount makes the chosen identity clear.

References

XEIZE DocumentationTechnical support