automountServiceAccountToken to false?

[samc1213]

I am not deeply familiar with the scope of the pod security admission policies. However, it seems that setting automountServiceAccountToken to true (the default) on a pod spec can allow a pod to escalate privileges via kubernetes API access. Is there a reason there is not a rule for this pod spec configuration in the Pod Security Standards?

[joebowbeer]

According to its description, this repo implements the pod security standards (PSS), which do not include an automountServiceAccountToken restriction:

https://kubernetes.io/docs/concepts/security/pod-security-standards/

While I think the ability to restrict automountServiceAccountToken would be helpful in a general purpose admission policy library, which this apparently is not, I don't think it would be feasible to enforce it in all namespaces at this time, for the reasons explained here:

nginxinc/kubernetes-ingress#3562 (comment)

Before it could be enforced cluster-wide, nginx and a lot of other popular controllers would need to change the way they obtain their token.