Back to Checks
kubernetes

API server pod has --service-account-lookup set to true

apiserver_service_account_lookup_true
Service: apiserverSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityidentity-access
Resource Type:Pod

Kubernetes API server has service account lookup enabled via --service-account-lookup=true, validating presented service account tokens against currently existing ServiceAccounts during authentication.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without service account lookup, tokens tied to deleted or renamed ServiceAccounts can still authenticate, enabling persistence with stale credentials, unauthorized API access, and lateral movement, degrading confidentiality and integrity of cluster resources.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_service_account_lookup_true

Recommendation

Enable --service-account-lookup=true so token validity depends on the ServiceAccount's current state. Apply least privilege to ServiceAccounts, favor short-lived tokens, and promptly remove unused accounts and secrets. Combine with strict RBAC and auditing for defense in depth.

Remediation

Other

1SSH to each control plane node with root privileges
2Edit the static Pod manifest: sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
3In the kube-apiserver container command list, add the flag:
4```
5--service-account-lookup=true
6```
7Save the file; the kubelet will automatically restart the API server
8Verify the flag is active: ps aux | grep kube-apiserver | grep -- --service-account-lookup=true

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_service_account_lookup_true(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Service account lookup is set to true in pod {pod.name}."
            )

            for container in pod.containers.values():
                # Check if "--service-account-lookup" is set to true
                if "--service-account-lookup=true" not in str(container.command):
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Service account lookup is not set to true in pod {pod.name}."
                    )
                    break

            findings.append(report)
        return findings

References