OCI OKE Service Account Token Mounting Should Be Restricted

Using Console

In OKE this is a Kubernetes‑level setting, but you can fix it entirely starting from the OCI Console by using the built‑in Cloud Shell and the OKE UI.Below are concise, step‑by‑step instructions.

1. Open Your OKE Cluster from OCI Console

Sign in to OCI Console.
In the left menu: Developer Services → Kubernetes Clusters (OKE).
Select the compartment that contains the cluster.
Click on your cluster name.

2. Get `kubectl` Access from the Console (Cloud Shell)

On the cluster details page, click Access Cluster.
Choose Cloud Shell (recommended) so you run commands directly from the browser.
In the panel that opens, click the button to Set Up Cluster Access (this usually runs the oci ce cluster create-kubeconfig… command for you).
Verify connectivity:
kubectl get nodes

3. Identify Service Accounts That Auto‑Mount Tokens

By default, service accounts auto‑mount tokens unless you disable it. Find which service accounts are doing that.

List all service accounts in all namespaces:
kubectl get sa -A
For each namespace where you have workloads, check whether automountServiceAccountToken is set:
kubectl get sa -n <NAMESPACE> -o yaml
You will see either:
- No automountServiceAccountToken field (means default true), or
- automountServiceAccountToken: true, or
- automountServiceAccountToken: false.

Your goal is to ensure it is false by default and only enabled where strictly needed.

4. Disable Token Auto‑Mounting at the Service Account Level

For each service account that should not have tokens automatically mounted:

Edit the service account:

kubectl edit sa <SERVICE_ACCOUNT_NAME> -n <NAMESPACE>

In the YAML that opens, under metadata: (same level as secrets:), add or change:

automountServiceAccountToken: false

Example:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app-sa
  namespace: my-app-namespace
automountServiceAccountToken: false

Save and exit (in vi, press Esc, then type :wq and press Enter).

Repeat for every service account that should not expose the token.

5. Override at Pod/Workload Level (Only Where Needed)

Some workloads may legitimately need the service account token. For those, keep the service account default as false, and enable auto‑mount only at the Pod / workload level.

5.1. Edit the Deployment/StatefulSet/Pod

List deployments in a namespace:
kubectl get deploy -n <NAMESPACE>

Edit the workload that needs the token:

kubectl edit deploy <DEPLOYMENT_NAME> -n <NAMESPACE>

Under spec.template.spec, add:

automountServiceAccountToken: true

Example:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-api
  namespace: my-app-namespace
spec:
  replicas: 2
  selector:
    matchLabels:
      app: my-api
  template:
    metadata:
      labels:
        app: my-api
    spec:
      serviceAccountName: my-api-sa
      automountServiceAccountToken: true
      containers:
        - name: api
          image: <IMAGE>

Save and exit; Kubernetes will roll out updated pods.

6. Validate That Tokens Are No Longer Auto‑Mounted

After changes roll out, check one of the pods:

kubectl get pods -n <NAMESPACE>
kubectl exec -it <POD_NAME> -n <NAMESPACE> -- sh

Inside the container, confirm that the token file is absent for workloads that should not have it:
ls /var/run/secrets/kubernetes.io/serviceaccount
- If directory or token file is missing, auto‑mount is effectively disabled.
- For workloads that should have it, it should still exist.

7. (Optional) Use the OKE Workloads UI Instead of `kubectl edit`

If you prefer not to edit YAML via terminal:

In OCI Console → your OKE cluster → left menu Workloads.
Choose the correct namespace.
Click on a Deployment / StatefulSet / Pod.
Use Edit YAML (or equivalent) and:
- For ServiceAccount objects, add automountServiceAccountToken: false.
- For Pod templates under workloads, add spec.automountServiceAccountToken: true only where needed.
Save; OKE will apply the updated manifest.

Summary of the remediation:

Set automountServiceAccountToken: false on all service accounts by default.
Only enable automountServiceAccountToken: true at the pod/workload level where a token is strictly required.
All of this can be done starting from the OCI Console using the OKE page + Cloud Shell or the Workloads UI editor.

Using CLI

In OKE this is remediated with standard Kubernetes controls; OCI CLI is only used to get your kubeconfig so you can run kubectl against the cluster.Below are the steps using OCI CLI + kubectl.

1. Get kubeconfig for your OKE cluster (via OCI CLI)

# Set env vars for convenience
COMPARTMENT_OCID="<your_compartment_ocid>"
CLUSTER_OCID="<your_oke_cluster_ocid>"

# Generate kubeconfig
oci ce cluster create-kubeconfig \
  --cluster-id "$CLUSTER_OCID" \
  --file "$HOME/.kube/oke-config" \
  --region "<your_region>" \
  --token-version 2.0.0 \
  --kube-endpoint PUBLIC_ENDPOINT

# Point KUBECONFIG to that file (or merge it with your existing config)
export KUBECONFIG=$HOME/.kube/oke-config

Confirm access:

kubectl get nodes

2. Disable token auto-mounting at the ServiceAccount level

For each namespace, disable token auto-mounting on the default ServiceAccount (or any SA you use):

NAMESPACE="<your_namespace>"

kubectl patch serviceaccount default \
  -n "$NAMESPACE" \
  -p '{"automountServiceAccountToken": false}'

To verify:

kubectl get sa default -n "$NAMESPACE" -o yaml | grep -i automountServiceAccountToken -A1

Create new ServiceAccounts with token mounting disabled by default:

kubectl create serviceaccount restricted-sa -n "$NAMESPACE"

kubectl patch serviceaccount restricted-sa \
  -n "$NAMESPACE" \
  -p '{"automountServiceAccountToken": false}'

3. Disable token auto-mounting at the Pod/Deployment level

For existing Deployments/Pods that must not have tokens, explicitly set automountServiceAccountToken: false:

NAMESPACE="<your_namespace>"
DEPLOYMENT="<your_deployment_name>"

kubectl patch deployment "$DEPLOYMENT" \
  -n "$NAMESPACE" \
  -p '{"spec": {"template": {"spec": {"automountServiceAccountToken": false}}}}'

For raw Pods you can patch similarly:

POD="<your_pod_name>"

kubectl patch pod "$POD" \
  -n "$NAMESPACE" \
  -p '{"spec": {"automountServiceAccountToken": false}}'

When defining new workloads, include in the pod spec:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: example
  namespace: your-namespace
spec:
  template:
    spec:
      serviceAccountName: restricted-sa
      automountServiceAccountToken: false
      containers:
      - name: app
        image: your-image

4. Optionally audit current ServiceAccount token usage

List all ServiceAccounts and check for automountServiceAccountToken:

for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}'); do
  echo "Namespace: $ns"
  kubectl get sa -n "$ns" -o jsonpath='{range .items[*]}{.metadata.name}{"  ->  "}{.automountServiceAccountToken}{"\n"}{end}'
  echo
done

Patch any with true or unset (Kubernetes default is true) as above.

Using Python

To restrict OKE service account token mounting you need to:

Turn off automatic token mounting at the ServiceAccount level (cluster-wide or per namespace).
Explicitly turn it on only for workloads that truly need it.
Do this programmatically using the Kubernetes Python client.

Below is a concise, step‑by‑step approach and example Python code.

1. Prerequisites

Ensure you can access your OKE cluster with kubectl:
kubectl get nodes
Install the Kubernetes Python client:
pip install kubernetes
Ensure your KUBECONFIG (or default ~/.kube/config) is set to the OKE cluster context you want to fix.

2. Hardening Strategy

Best practice:

Set automountServiceAccountToken: false on all ServiceAccounts by default, especially the default ServiceAccount in every namespace.
For Pods/Deployments that actually need the token (e.g., in‑cluster controllers, tools using Kubernetes API), explicitly set:
spec: automountServiceAccountToken: true

We’ll focus here on disabling it cluster‑wide by default via Python.

3. Python Script: Disable Token Mounting for ServiceAccounts

This script:

Connects to the OKE cluster using your kubeconfig.
Iterates through all namespaces.
For each ServiceAccount (including default), sets automountServiceAccountToken: false unless you explicitly exempt it (via a skip list).

from kubernetes import client, config
from kubernetes.client.rest import ApiException

# Namespaces or service accounts you may want to skip (if they require token)
NAMESPACE_SKIP_LIST = []  # e.g. ["kube-system", "oracle-oci"]
SA_SKIP_LIST = []         # e.g. ["cluster-autoscaler"]

def main():
    # Load kubeconfig from default location (~/.kube/config) or KUBECONFIG env
    config.load_kube_config()

    v1 = client.CoreV1Api()

    try:
        namespaces = v1.list_namespace().items
    except ApiException as e:
        print(f"Error listing namespaces: {e}")
        return

    for ns in namespaces:
        ns_name = ns.metadata.name
        if ns_name in NAMESPACE_SKIP_LIST:
            print(f"Skipping namespace: {ns_name}")
            continue

        try:
            sa_list = v1.list_namespaced_service_account(ns_name).items
        except ApiException as e:
            print(f"Error listing service accounts in {ns_name}: {e}")
            continue

        for sa in sa_list:
            sa_name = sa.metadata.name

            # Skip service accounts in SA_SKIP_LIST
            if sa_name in SA_SKIP_LIST:
                print(f"Skipping service account: {ns_name}/{sa_name}")
                continue

            # If already explicitly false, skip
            if sa.automount_service_account_token is False:
                print(f"No change (already false): {ns_name}/{sa_name}")
                continue

            # Patch the ServiceAccount to set automountServiceAccountToken: false
            patch_body = {
                "automountServiceAccountToken": False
            }

            try:
                v1.patch_namespaced_service_account(
                    name=sa_name,
                    namespace=ns_name,
                    body=patch_body
                )
                print(f"Updated: {ns_name}/{sa_name} -> automountServiceAccountToken=False")
            except ApiException as e:
                print(f"Error patching SA {ns_name}/{sa_name}: {e}")

if __name__ == "__main__":
    main()

Run it:

python harden_sa_tokens.py

4. (Optional) Explicitly Enable Token for Specific Workloads

For workloads that require the token, you can either:

Set at Pod spec level (preferred):

apiVersion: apps/v1
kind: Deployment
metadata:
  name: needs-token
  namespace: my-namespace
spec:
  template:
    spec:
      automountServiceAccountToken: true
      serviceAccountName: my-sa-that-needs-token

Or adjust SA_SKIP_LIST in the Python script so that their ServiceAccount keeps automountServiceAccountToken default or true, then upgrade/redeploy them.

5. Integrating with OCI / OKE Automation (Optional)

If you want to run this as part of CI/CD or automation:

Package the script into a container image.
Run it as a Job or CronJob inside the OKE cluster with a ServiceAccount that has permissions to list/patch ServiceAccounts (rbac ClusterRole with get, list, patch on serviceaccounts).
Or run from an OCI DevOps pipeline or OCI Shell with kubeconfig pointing to the OKE cluster.

If you share how your OKE clusters are provisioned (Terraform, OCI Resource Manager, manual), I can add Terraform or pipeline examples to enforce this setting at creation time as well.

Using Terraform

This setting cannot be controlled on the oci_containerengine_cluster (Terraform oci_containerengine_cluster) resource: the OCI Container Engine for Kubernetes API does not expose a cluster‑level flag to set automountServiceAccountToken=false by default.To remediate with Terraform you must manage this at the Kubernetes object level (not on the OKE cluster resource), for example by:

Defining kubernetes_service_account resources (via the hashicorp/kubernetes provider) with automount_service_account_token = false and only enabling it where explicitly required, or
Applying Kubernetes manifests (e.g., via kubectl, Helm, or Terraform kubernetes_manifest/helm_release) that set automountServiceAccountToken: false on ServiceAccounts/Pods, and/or admission policies that enforce this.

In the OCI Console, you would instead edit your Kubernetes ServiceAccounts (or controlling templates/Helm charts) to set automountServiceAccountToken: false by default and enable it only for workloads that truly need the token.

OCI Misconfigurations

OCI OKE Service Account Token Mounting Should Be Restricted

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Open Your OKE Cluster from OCI Console

2. Get `kubectl` Access from the Console (Cloud Shell)

3. Identify Service Accounts That Auto‑Mount Tokens

4. Disable Token Auto‑Mounting at the Service Account Level

5. Override at Pod/Workload Level (Only Where Needed)

5.1. Edit the Deployment/StatefulSet/Pod

6. Validate That Tokens Are No Longer Auto‑Mounted

7. (Optional) Use the OKE Workloads UI Instead of `kubectl edit`

1. Get kubeconfig for your OKE cluster (via OCI CLI)

2. Disable token auto-mounting at the ServiceAccount level

3. Disable token auto-mounting at the Pod/Deployment level

4. Optionally audit current ServiceAccount token usage

1. Prerequisites

2. Hardening Strategy

3. Python Script: Disable Token Mounting for ServiceAccounts

4. (Optional) Explicitly Enable Token for Specific Workloads

5. Integrating with OCI / OKE Automation (Optional)

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Open Your OKE Cluster from OCI Console

​2. Get kubectl Access from the Console (Cloud Shell)

​3. Identify Service Accounts That Auto‑Mount Tokens

​4. Disable Token Auto‑Mounting at the Service Account Level

​5. Override at Pod/Workload Level (Only Where Needed)

​5.1. Edit the Deployment/StatefulSet/Pod

​6. Validate That Tokens Are No Longer Auto‑Mounted

​7. (Optional) Use the OKE Workloads UI Instead of kubectl edit

​1. Get kubeconfig for your OKE cluster (via OCI CLI)

​2. Disable token auto-mounting at the ServiceAccount level

​3. Disable token auto-mounting at the Pod/Deployment level

​4. Optionally audit current ServiceAccount token usage

​1. Prerequisites

​2. Hardening Strategy

​3. Python Script: Disable Token Mounting for ServiceAccounts

​4. (Optional) Explicitly Enable Token for Specific Workloads

​5. Integrating with OCI / OKE Automation (Optional)

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Open Your OKE Cluster from OCI Console

2. Get `kubectl` Access from the Console (Cloud Shell)

3. Identify Service Accounts That Auto‑Mount Tokens

4. Disable Token Auto‑Mounting at the Service Account Level

5. Override at Pod/Workload Level (Only Where Needed)

5.1. Edit the Deployment/StatefulSet/Pod

6. Validate That Tokens Are No Longer Auto‑Mounted

7. (Optional) Use the OKE Workloads UI Instead of `kubectl edit`

1. Get kubeconfig for your OKE cluster (via OCI CLI)

2. Disable token auto-mounting at the ServiceAccount level

3. Disable token auto-mounting at the Pod/Deployment level

4. Optionally audit current ServiceAccount token usage

1. Prerequisites

2. Hardening Strategy

3. Python Script: Disable Token Mounting for ServiceAccounts

4. (Optional) Explicitly Enable Token for Specific Workloads

5. Integrating with OCI / OKE Automation (Optional)