Back to Checks
kubernetes

API server pod has --service-account-key-file configured

apiserver_service_account_key_file_set
Service: apiserverSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityidentity-access
Resource Type:Pod

Kubernetes API server uses --service-account-key-file to supply the public key(s) for validating service account tokens.

Detection looks for API server containers that lack this flag.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without a dedicated key file, token validation can fall back to the API server's TLS key, eroding separation of duties. Compromise or rotation of that key can enable token forgery (confidentiality/integrity) or invalidate tokens, disrupting workloads (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_service_account_key_file_set

Recommendation

Use a dedicated key pair for service accounts:

  • Configure --service-account-key-file with public keys for validation
  • Keep signing and serving keys separate (least privilege)
  • Enforce scheduled key rotation and maintain multiple active keys for defense in depth

Remediation

Other

1SSH to the control plane node.
2Edit the API server static pod manifest:
3sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
4In spec.containers[0].command add this line:
5```
6- --service-account-key-file=/etc/kubernetes/pki/sa.pub
7```
8Save the file; the kubelet will restart the API server automatically.

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_service_account_key_file_set(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Service account key file is set appropriately in pod {pod.name}."
            )

            for container in pod.containers.values():
                # Check if "--service-account-key-file" is set
                if "--service-account-key-file" not in str(container.command):
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Service account key file is not set in pod {pod.name}."
                    )
                    break

            findings.append(report)
        return findings

References