Back to Checks
kubernetes

Controller Manager pod has --use-service-account-credentials=true

controllermanager_service_account_credentials
Service: controllermanagerSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityidentity-access
Resource Type:Pod

Evaluates whether the Kubernetes controller manager uses per-controller service account credentials via --use-service-account-credentials=true, meaning each controller runs with its own identity rather than a shared credential.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without per-controller credentials, one token can grant broad controller privileges. Compromise or misuse enables unauthorized state changes, data exposure, and lateral movement, while reducing audit granularity-impacting confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks controllermanager_service_account_credentials

Recommendation

Enable --use-service-account-credentials=true and enforce least privilege: assign a dedicated service account per controller with minimal RBAC, limit token scope/lifetime, and monitor controller actions. This upholds separation of duties and defense in depth.

Remediation

Other

1SSH to each control-plane node
2Edit the static Pod manifest: /etc/kubernetes/manifests/kube-controller-manager.yaml
3Under spec.containers[0].command, add a new item: --use-service-account-credentials=true
4Save the file; the kubelet will automatically restart the controller-manager

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.controllermanager.controllermanager_client import (
    controllermanager_client,
)


class controllermanager_service_account_credentials(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in controllermanager_client.controllermanager_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Controller Manager is not using service account credentials in pod {pod.name}."
            for container in pod.containers.values():
                if "--use-service-account-credentials=true" not in str(
                    container.command
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Controller Manager is using service account credentials in pod {pod.name}."
                    break
            findings.append(report)
        return findings

References