Exercise: stop the token from being mounted

Host: controlplane · Time: 6 min · Domain: Cluster Hardening

Task

• ServiceAccount api and Deployment client exist in prod.
• No Pod of client may have the service account token mounted.
• client must keep running.

Acceptance criteria

• kubectl exec -n prod deploy/client -- ls /var/run/secrets/kubernetes.io/serviceaccount fails with "No such file or directory".
• The Deployment has its desired number of ready replicas.

Solution

kubectl patch sa api -n prod -p '{"automountServiceAccountToken": false}'
kubectl patch deployment client -n prod --type=strategic -p \
 '{"spec":{"template":{"spec":{"automountServiceAccountToken":false}}}}'
kubectl rollout status deployment/client -n prod
kubectl exec -n prod deploy/client -- ls /var/run/secrets/kubernetes.io/serviceaccount/

Note: serviceAccountName is immutable — if the task wants a different SA
rather than no token, delete and recreate (kubectl replace --force).