Is the `automountServiceAccountToken: false` necessary with SCC
Issue
The violation of
"Protect pod default service account tokens from compromise by minimizing the mounting of the default service account token to only those pods whose application requires interaction with the Kubernetes API."
has a suggested remediation of
"Add `automountServiceAccountToken: false` or a value distinct from 'default' for the `serviceAccountName` key to the deployment's Pod configuration."
Is this necessary, given that SecurityContextConstraints limit access to the kubernetes API and the default account has a restricted SCC?
Environment
- Red Hat Advanced Cluster Security (RHACS)
- 4.1
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
