Back to Checks
kubernetes

Controller Manager pod has the --service-account-private-key-file argument set

controllermanager_service_account_private_key_file
Service: controllermanagerSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securitysecrets
Resource Type:Pod

Kubernetes controller manager uses a service account signing key configured via --service-account-private-key-file.

The evaluation identifies whether this argument is present, indicating the component can sign service account tokens.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without a configured signing key, the token controller can't mint service account tokens, breaking pod-to-API auth and controller operations (availability). Inability to rotate keys prolongs validity of stolen or stale tokens, weakening integrity and confidentiality.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks controllermanager_service_account_private_key_file

Recommendation

Set a dedicated signing key using --service-account-private-key-file, or adopt an approved external signer.

Apply least privilege to key access, enforce regular rotation and rollover, separate signing/verification duties, and prefer short-lived tokens with strict RBAC.

Remediation

Other

1SSH to the control plane node
2Edit /etc/kubernetes/manifests/kube-controller-manager.yaml
3Under containers[].command, add: - --service-account-private-key-file=/etc/kubernetes/pki/sa.key
4Save the file; the kubelet will restart the kube-controller-manager pod automatically

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.controllermanager.controllermanager_client import (
    controllermanager_client,
)


class controllermanager_service_account_private_key_file(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in controllermanager_client.controllermanager_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Controller Manager does not have the service account private key file set in pod {pod.name}."
            for container in pod.containers.values():
                if "--service-account-private-key-file=" not in str(container.command):
                    report.status = "FAIL"
                    report.status_extended = f"Controller Manager has the service account private key file set in pod {pod.name}."
                    break
            findings.append(report)
        return findings

References