Task

SkillCloud & infra

Reviews Kubernetes ServiceAccount configurations for identity management and least privilege boundaries.

Available today. Use it from your connected AI after setup.

Connect ahel once, and every AI you use reads what you have installed.

Then ask your AI: use the Task skill

What this skill tells your AI

The instructions your AI receives, as published by gke-labs/kube-agents in .agents/skills/review-security-k8s-service-accounts/SKILL.md and read by ahel’s review.

Review Kubernetes ServiceAccount resources/configurations to ensure least privilege and strict identity boundaries.

Checks

1. Identity Boundaries & Defaults

  • Default Usage: Flag RBAC bindings assigned to the default service account.
  • Identity Sprawl: Flag custom ServiceAccounts shared across distinct applications. Enforce 1:1 app-to-account mapping.
  • Token Automounting: Require automountServiceAccountToken: false on ServiceAccounts.

2. Cloud IAM Bridges

  • Workload Identity: Flag ServiceAccounts shared across workloads mapped to a single cloud identity (e.g., GCP iam.gke.io/gcp-service-account).

3. Legacy & Over-provisioning

  • Long-lived Tokens: Flag explicit Secret objects of type kubernetes.io/service-account-token. Require ephemeral TokenRequest API.
  • Image Pull Secrets: Ensure imagePullSecrets don't grant broad access to corporate registries.
  • Orphaned Identities: Flag ServiceAccounts with RBAC bindings but no active workloads.

Signals

GitHub stars
54
Forks
36
Last commit
Sep 2026
Advanced
Catalog kind
skill
Gateway key
review-security-k8s-service-accounts
Source
github.com/gke-labs/kube-agents