Ensure Service Account Tokens Are Only Mounted Where Necessary

kubectl get serviceaccounts --all-namespaces -o yaml > /tmp/all-serviceaccounts.yaml

kubectl get serviceaccounts --all-namespaces -o json \
  | jq -r '.items[]
    | select(.automountServiceAccountToken == true)
    | [.metadata.namespace, .metadata.name, .automountServiceAccountToken]
    | @tsv'

kubectl get pods --all-namespaces -o yaml > /tmp/all-pods.yaml

kubectl get pods --all-namespaces -o json \
  | jq -r '.items[]
    | select(.spec.automountServiceAccountToken == true)
    | [.metadata.namespace, .metadata.name, .spec.serviceAccountName, .spec.automountServiceAccountToken]
    | @tsv'

kubectl get pods --all-namespaces -o json \
  | jq -r '.items[]
    | select(.spec.automountServiceAccountToken == null)
    | [.metadata.namespace, .metadata.name, .spec.serviceAccountName]
    | @tsv'

for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}'); do
  for pod in $(kubectl get pods -n "$ns" --no-headers -o custom-columns=':metadata.name'); do
    echo "=== $ns/$pod ==="
    kubectl exec -n "$ns" "$pod" -- sh -c 'ls -l /var/run/secrets/kubernetes.io/serviceaccount 2>/dev/null || echo "no token directory"'
  done
done

kubectl get serviceaccounts --all-namespaces -o yaml > /tmp/all-serviceaccounts.yaml
kubectl get pods --all-namespaces -o yaml > /tmp/all-pods.yaml

#!/usr/bin/env bash
# Audit service account token mounting across the whole cluster
# Run on: any machine with kubectl access and current context set

set -euo pipefail

echo "=== 1) Cluster-wide ServiceAccount defaults (automountServiceAccountToken) ==="
echo
echo "# Namespaces where the default for ServiceAccounts is NOT explicitly disabled (potentially risky):"
kubectl get sa --all-namespaces -o json \
  | jq -r '
    .items[]
    | {
        ns: .metadata.namespace,
        name: .metadata.name,
        automount: ( .automountServiceAccountToken // "inherited" )
      }
    | [ .ns, .name, .automount ]
    | @tsv' \
  | column -t

cat <<'EOF'

Interpretation:
- If "automount" is "true": this ServiceAccount will mount a token into pods by default (higher risk).
- If "automount" is "false": this ServiceAccount will NOT mount a token by default (more secure).
- If "automount" is "inherited": it follows the namespace or cluster default; review pods using it.

Risk indicators:
- ServiceAccounts used by workloads that do NOT need to call the API server but show "true" or "inherited".
EOF

echo
echo "=== 2) Pods and their effective token-mount setting ==="
echo
echo "# Listing all pods with the effective automount behavior and what it is derived from:"
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | . as $pod
    | $pod.spec.serviceAccountName as $sa
    | $pod.metadata.namespace as $ns
    | $pod.metadata.name as $podname
    | (
        if $pod.spec.automountServiceAccountToken != null then
          {source:"pod", value:$pod.spec.automountServiceAccountToken}
        else
          (
            (input_filename | .) as $f
          )
        end
      )' 2>/dev/null || true

#!/usr/bin/env bash
set -euo pipefail

echo "=== 2) Pods and their effective token-mount setting (explicit view) ==="
echo
# For each pod, show:
# - namespace, pod name
# - serviceAccountName
# - pod-level automountServiceAccountToken (if set)
# - ServiceAccount-level automountServiceAccountToken (if set)
# Note: effective behavior is:
#   pod.automount (if not null) else SA.automount (if not null) else namespace/cluster default (usually true)
kubectl get pods --all-namespaces -o json \
  | jq -r '
    .items[]
    | .metadata.namespace as $ns
    | .metadata.name as $podname
    | .spec.serviceAccountName as $sa
    | .spec.automountServiceAccountToken as $pod_auto
    | {
        ns: $ns,
        pod: $podname,
        sa: $sa,
        pod_auto: (if $pod_auto==null then "unset" else $pod_auto|tostring end)
      }
    | @base64' \
  | while read -r line; do
      obj=$(echo "$line" | base64 -d)
      ns=$(echo "$obj" | jq -r '.ns')
      pod=$(echo "$obj" | jq -r '.pod')
      sa=$(echo "$obj" | jq -r '.sa')
      pod_auto=$(echo "$obj" | jq -r '.pod_auto')

      # Look up SA-level automount for this pod
      sa_auto=$(kubectl get sa "$sa" -n "$ns" -o json 2>/dev/null \
        | jq -r '.automountServiceAccountToken // "unset"' || echo "missing-SA")

      printf "%s\t%s\t%s\tpod_auto=%s\tsa_auto=%s\n" "$ns" "$pod" "$sa" "$pod_auto" "$sa_auto"
    done \
  | column -t | sed '1iNAMESPACE  POD  SERVICEACCOUNT  POD_AUTOMOUNT  SA_AUTOMOUNT'

cat <<'EOF'

Interpretation:
- POD_AUTOMOUNT=unset and SA_AUTOMOUNT=unset:
  - Pod inherits namespace/cluster default (commonly true) -> likely mounts a token.
- POD_AUTOMOUNT=true:
  - Pod will mount a token regardless of SA/namespace defaults (higher risk if API not needed).
- POD_AUTOMOUNT=false:
  - Pod will NOT mount a token even if SA/namespace defaults are true (more secure).
- SA_AUTOMOUNT=true:
  - All pods using this SA (that do not override at pod level) will mount a token.
- SA_AUTOMOUNT=false:
  - Pods using this SA will not mount a token unless they explicitly set POD_AUTOMOUNT=true.

Risk indicators (potential problems to review):
- Pods that do NOT need to talk to the Kubernetes API but show:
  - POD_AUTOMOUNT=true, OR
  - POD_AUTOMOUNT=unset and SA_AUTOMOUNT=true or unset (i.e., likely mounting a token).
- Namespaces or teams where *every* ServiceAccount has automount=true or unset by default.
EOF