Task
SkillCloud & infraReviews Kubernetes ServiceAccount configurations for identity management and least privilege boundaries.
Available today. Use it from your connected AI after setup.
No other account needed.
Connect ahel once, and every AI you use reads what you have installed.
Then ask your AI: use the Task skill
What this skill tells your AI
The instructions your AI receives, as published by gke-labs/kube-agents in .agents/skills/review-security-k8s-service-accounts/SKILL.md and read by ahel’s review.
Review Kubernetes ServiceAccount resources/configurations to ensure least privilege and strict identity boundaries.
Checks
1. Identity Boundaries & Defaults
- Default Usage: Flag RBAC bindings assigned to the
defaultservice account. - Identity Sprawl: Flag custom ServiceAccounts shared across distinct applications. Enforce 1:1 app-to-account mapping.
- Token Automounting: Require
automountServiceAccountToken: falseon ServiceAccounts.
2. Cloud IAM Bridges
- Workload Identity: Flag ServiceAccounts shared across workloads mapped to a single cloud identity (e.g., GCP
iam.gke.io/gcp-service-account).
3. Legacy & Over-provisioning
- Long-lived Tokens: Flag explicit
Secretobjects of typekubernetes.io/service-account-token. Require ephemeralTokenRequestAPI. - Image Pull Secrets: Ensure
imagePullSecretsdon't grant broad access to corporate registries. - Orphaned Identities: Flag ServiceAccounts with RBAC bindings but no active workloads.
Signals
- GitHub stars
- 54
- Forks
- 36
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
review-security-k8s-service-accounts- Source
- github.com/gke-labs/kube-agents