A service account is a non-human identity used by a Kubernetes workload to call the Kubernetes API. Audit events record that identity in principalEmail, making service accounts central to deciding whether API activity is expected or suspicious. section 5.1.3
A pod without an explicitly specified service account receives the default service account for its namespace. That account has no permissions by default, but RoleBindings can change its effective access, so default-account activity warrants review. section 5.1.3 section 5.3.3
Investigate a service account by following the evidence:
- Filter Kubernetes API audit events by source IP, user agent, decision, and principalEmail to associate API calls with an account. section 5.1.3
- Inspect allowed and forbidden methods for an unexpected account, then check its permissions with kubectl auth can-i --list. section 5.1.3
- Search RoleBinding creation events affecting the default account to identify authorization changes that explain new access. section 5.1.3
- Monitor calls and changes to default service accounts as part of Kubernetes detection and prevention practice. section 5.3.3
Investigating a default account
API logs show system:serviceaccount:chapter5:default making allowed pod, service, and namespace requests through kubectl. Checking its permissions reveals broad access; RoleBinding audit records can then establish whether that access was added and by whom. section 5.1.3
Listing 5.4 Sample Kubernetes API server event
{
"@timestamp": "2022-03-05T07:29:11.000Z",
"insertId": "931625f0-953d-45e8-abfc-1f5fab04d588",
"labels": {
"authorization.k8s.io/decision": "allow", #1
"authorization.k8s.io/reason": "access granted by IAM permissions."
},
...
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"principalEmail": "*****@*****" #2
},
"authorizationInfo": [
{
"granted": true,
"permission": "io.k8s.core.v1.pods.list",
"resource": "core/v1/namespaces/chapter5/pods" #3
}
],
"methodName": "io.k8s.core.v1.pods.list",
"requestMetadata": {
"callerIp": "193.188.105.36", #4
"callerSuppliedUserAgent": "kubectl/v1.21.4
(darwin/amd64) kubernetes/3cce4a8" #5
},
"resourceName": "core/v1/namespaces/chapter5/pods", #6
"serviceName": "k8s.io"
},
"receiveTimestamp": "2022-03-05T07:29:10.454104682Z",
"resource": {
"labels": {
"cluster_name": "production", #7
"location": "us-west1-a",
"project_id": "prismatic-rock-335909"
},
"type": "k8s_cluster"
}
Use the sample Kubernetes API event to locate the authorization decision, principalEmail, requested permission and resource, caller IP, and user agent needed for attribution. section 5.1.3
