Table: kubernetes_service_account - Query Kubernetes Service Accounts using SQL

Kubernetes Service Account is a type of Kubernetes resource that provides an identity for processes that run in a Pod. Service accounts are namespaced and can provide identity for applications running within a namespace. They are used to provide specific permissions to applications, allowing more granular control over system access.

Table Usage Guide

The kubernetes_service_account table provides insights into service accounts within Kubernetes. As a DevOps engineer, explore service account-specific details through this table, including their metadata, secrets, image pull secrets, and automount service account token. Utilize it to uncover information about service accounts, such as their respective namespaces, the secrets they hold, and their automount settings.

Examples

Basic Info - `kubectl get serviceaccounts --all-namespaces` columns

Determine the areas in which Kubernetes service accounts are deployed and assess the number of secrets associated with each, while also gaining insights into their age. This query is useful for maintaining security and managing resource allocation within your Kubernetes environment.

select
  name,
  namespace,
  jsonb_array_length(secrets) as secrets,
  age(current_timestamp, creation_timestamp)
from
  kubernetes_service_account
order by
  namespace,
  name;

select
  name,
  namespace,
  json_array_length(secrets) as secrets,
  strftime('%s', 'now') - strftime('%s', creation_timestamp) as age
from
  kubernetes_service_account
order by
  namespace,
  name;

List role bindings

Explore the connections between service accounts and role bindings in a Kubernetes environment. This can help you understand the permissions and access levels of different service accounts, which is crucial for managing security and access control.

select
  sub ->> 'name' as service_account_name,
  sub ->> 'namespace' as service_account_namespace,
  name as role_binding,
  role_name,
  role_kind
from
  kubernetes_role_binding,
  jsonb_array_elements(subjects) as sub
where
  sub ->> 'kind' = 'ServiceAccount';

select
  json_extract(sub.value, '$.name') as service_account_name,
  json_extract(sub.value, '$.namespace') as service_account_namespace,
  name as role_binding,
  role_name,
  role_kind
from
  kubernetes_role_binding,
  json_each(subjects) as sub
where
  json_extract(sub.value, '$.kind') = 'ServiceAccount';

List cluster role bindings and rules

Explore the associations between cluster role bindings and their rules in a Kubernetes environment. This is useful for understanding the permissions and access levels of different service accounts, aiding in security and access management.

select
  crb.name as cluster_role_binding,
  crb.role_name,
  crb_sub ->> 'name' as service_account_name,
  crb_sub ->> 'namespace' as service_account_namespace,
  cr_rule ->> 'apiGroups' as rule_api_groups,
  cr_rule ->> 'resources' as rule_resources,
  cr_rule ->> 'verbs' as rule_verbs,
  cr_rule ->> 'resourceNames' as rule_resource_names
from
  kubernetes_cluster_role_binding as crb,
  jsonb_array_elements(subjects) as crb_sub,
  kubernetes_cluster_role as cr,
  jsonb_array_elements(cr.rules) as cr_rule
where
  cr.name = crb.role_name
  and crb_sub ->> 'kind' = 'ServiceAccount';

select
  crb.name as cluster_role_binding,
  crb.role_name,
  json_extract(crb_sub.value, '$.name') as service_account_name,
  json_extract(crb_sub.value, '$.namespace') as service_account_namespace,
  json_extract(cr_rule.value, '$.apiGroups') as rule_api_groups,
  json_extract(cr_rule.value, '$.resources') as rule_resources,
  json_extract(cr_rule.value, '$.verbs') as rule_verbs,
  json_extract(cr_rule.value, '$.resourceNames') as rule_resource_names
from
  kubernetes_cluster_role_binding as crb,
  json_each(crb.subjects) as crb_sub,
  kubernetes_cluster_role as cr,
  json_each(cr.rules) as cr_rule
where
  cr.name = crb.role_name
  and json_extract(crb_sub.value, '$.kind') = 'ServiceAccount';

List manifest resources

Discover the segments that have assigned secrets within the Kubernetes service accounts, allowing for a thorough review and management of these resources. This is useful for maintaining security and ensuring proper access controls are in place.

select
  name,
  namespace,
  jsonb_array_length(secrets) as secrets,
  path
from
  kubernetes_service_account
where
  path is not null
order by
  namespace,
  name;

select
  name,
  namespace,
  json_array_length(secrets) as secrets,
  path
from
  kubernetes_service_account
where
  path is not null
order by
  namespace,
  name;

Query examples

Control examples

Schema for kubernetes_service_account

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
annotations	jsonb	Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata.
automount_service_account_token	boolean	Indicates whether pods running as this service account should have an API token automatically mounted. Can be overridden at the pod level.
context_name	text	Kubectl config context name.
creation_timestamp	timestamp with time zone	CreationTimestamp is a timestamp representing the server time when this object was created.
deletion_grace_period_seconds	bigint	Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set.
deletion_timestamp	timestamp with time zone	DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted.
end_line	bigint	The path to the manifest file.
finalizers	jsonb	Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed.
generate_name	text	GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided.
generation	bigint	A sequence number representing a specific generation of the desired state.
image_pull_secrets	jsonb	List of references to secrets in the same namespace to use for pulling any images in pods that reference this ServiceAccount. ImagePullSecrets are distinct from Secrets because Secrets can be mounted in the pod, but ImagePullSecrets are only accessed by the kubelet.
labels	jsonb	Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services.
name	text	Name of the object. Name must be unique within a namespace.
namespace	text	Namespace defines the space within which each name must be unique.
owner_references	jsonb	List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
path	text	The path to the manifest file.
resource_version	text	An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed.
secrets	jsonb	Secrets is the list of secrets allowed to be used by pods running using this ServiceAccount.
source_type	text	The source of the resource. Possible values are: deployed and manifest. If the resource is fetched from the spec file the value will be manifest.
start_line	bigint	The path to the manifest file.
tags	jsonb	A map of tags for the resource. This includes both labels and annotations.
title	text	Title of the resource.
uid	text	UID is the unique in time and space value for this object.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- kubernetes

You can pass the configuration to the command with the --config argument:

steampipe_export_kubernetes --config '<your_config>' kubernetes_service_account