K8s 1.28 RBAC ServiceAccount Permission Audit

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 5–15 mins

TL;DR

• What broke: Kubernetes 1.28 removed the legacy auto-grant of broad permissions to default ServiceAccounts. Any workload relying on the implicit ability to list/watch pods in the default namespace is now hard-blocked with a 403 Forbidden at the API server.
• How to fix it: Create an explicit Role scoped to the minimum required verbs (list, watch, get) and bind it to the ServiceAccount via a RoleBinding. Do not use ClusterRole unless cross-namespace access is genuinely required.
• Shortcut: Use our Client-Side Sandbox above to auto-refactor this — paste your ServiceAccount and broken deployment manifest and get a corrected Role + RoleBinding generated locally without sending your config anywhere.

Error from server (Forbidden): pods is forbidden:
User "system:serviceaccount:default:default" cannot list resource "pods"
in API group "" in namespace "default"

How to Fix It (The Solution)

Basic Fix — Explicit Least-Privilege Role

Create a dedicated ServiceAccount (stop using default), a scoped Role, and a RoleBinding.

- # No Role or RoleBinding existed. Workload used default SA with implicit permissions.
- # Pod spec:
- serviceAccountName: default

+ # Step 1: Dedicated ServiceAccount
+ apiVersion: v1
+ kind: ServiceAccount
+ metadata:
+   name: pod-reader-sa
+   namespace: default
+
+ ---
+ # Step 2: Least-privilege Role — only what the app actually needs
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: Role
+ metadata:
+   name: pod-reader
+   namespace: default
+ rules:
+ - apiGroups: [""]
+   resources: ["pods"]
+   verbs: ["get", "list", "watch"]
+
+ ---
+ # Step 3: Bind Role to ServiceAccount
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: RoleBinding
+ metadata:
+   name: pod-reader-binding
+   namespace: default
+ subjects:
+ - kind: ServiceAccount
+   name: pod-reader-sa
+   namespace: default
+ roleRef:
+   kind: Role
+   name: pod-reader
+   apiGroup: rbac.authorization.k8s.io
+
+ ---
+ # Step 4: Update Pod/Deployment spec
+ serviceAccountName: pod-reader-sa

Enterprise Best Practice — Namespace-Scoped, Auditable, Automated

- # Anti-pattern: ClusterRoleBinding to default SA (seen in legacy Helm charts)
- apiVersion: rbac.authorization.k8s.io/v1
- kind: ClusterRoleBinding
- metadata:
-   name: default-sa-admin  # THIS IS A CRITICAL MISCONFIGURATION
- subjects:
- - kind: ServiceAccount
-   name: default
-   namespace: default
- roleRef:
-   kind: ClusterRole
-   name: cluster-admin     # NEVER DO THIS
-   apiGroup: rbac.authorization.k8s.io

+ # Best practice: Namespace-scoped Role with explicit verb allowlist
+ # Add annotations for audit trail and ownership
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: Role
+ metadata:
+   name: pod-reader
+   namespace: default
+   annotations:
+     rbac.company.io/owner: "platform-team"
+     rbac.company.io/ticket: "PLAT-4821"
+     rbac.company.io/last-reviewed: "2024-01-15"
+ rules:
+ - apiGroups: [""]
+   resources: ["pods"]
+   verbs: ["get", "list", "watch"]
+   # Explicitly omit: create, delete, patch, update, exec
+ # If pod logs are needed, add separately and document why:
+ - apiGroups: [""]
+   resources: ["pods/log"]
+   verbs: ["get"]

Verify the fix before deploying:

# Dry-run auth check before applying
kubectl auth can-i list pods \
  --as=system:serviceaccount:default:pod-reader-sa \
  --namespace=default
# Expected: yes

# Confirm the old default SA no longer has implicit access
kubectl auth can-i list pods \
  --as=system:serviceaccount:default:default \
  --namespace=default
# Expected: no

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# rego policy: deny pods using the default service account
package kubernetes.admission

deny[msg] {
  input.request.kind.kind == "Pod"
  input.request.object.spec.serviceAccountName == "default"
  msg := "Pods must use a dedicated ServiceAccount, not 'default'. See PLAT-SEC-004."
}

# .github/workflows/k8s-security.yml
- name: Checkov RBAC Scan
  uses: bridgecrewio/checkov-action@master
  with:
    directory: ./k8s/
    check: CKV_K8S_41,CKV_K8S_42,CKV_K8S_43
    # CKV_K8S_41: Ensure no ServiceAccount has cluster-admin privileges
    # CKV_K8S_42: Ensure no wildcard verbs in Roles
    # CKV_K8S_43: Ensure default ServiceAccount is not bound to active Roles

# Find all RoleBindings/ClusterRoleBindings referencing the default SA
kubectl get rolebindings,clusterrolebindings \
  --all-namespaces \
  -o json | jq '[
    .items[] |
    select(
      .subjects[]? |
      (.kind == "ServiceAccount" and .name == "default")
    ) |
    {type: .kind, name: .metadata.name, namespace: .metadata.namespace, role: .roleRef.name}
  ]'