rage.fail

azure-aks-pod-executes-as-ksa

explicit azure emits ExecutesAs

match (record)

{ "field": "spec.serviceAccountName", "resource_type": "k8s/Pod|k8s/Deployment|k8s/DaemonSet|k8s/StatefulSet|k8s/Job" }

where

spec.serviceAccountName is set (non-empty)

emit

source type	`KubernetesWorkload`
target type	`WorkloadIdentity`
source	`<KubernetesWorkload (pod/deployment/daemonset/statefulset/job)>`
target	`<Kubernetes ServiceAccount (WorkloadIdentity) in the same namespace>`

Narrative

{workload.name} runs as Kubernetes ServiceAccount {ksa.name} (namespace {namespace.name}).

Raw rule rules/explicit/azure-aks.yaml

id: azure-aks-pod-executes-as-ksa
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: k8s/Pod|k8s/Deployment|k8s/DaemonSet|k8s/StatefulSet|k8s/Job
  field: spec.serviceAccountName
where:
- spec.serviceAccountName is set (non-empty)
emit:
  source_type: KubernetesWorkload
  target_type: WorkloadIdentity
  source: <KubernetesWorkload (pod/deployment/daemonset/statefulset/job)>
  target: <Kubernetes ServiceAccount (WorkloadIdentity) in the same namespace>
  api_source: kubectl get <kind> -n <namespace> <name> -o yaml
  evidence_field: spec.serviceAccountName
  narrative: '{workload.name} runs as Kubernetes ServiceAccount {ksa.name} (namespace {namespace.name}).'