How do I install the Cis K8S V1120 1.3.3 skill?

Run npx skillmds@latest add cyberstrikeus/cis-k8s-v1120-1-3-3 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis K8S V1120 1.3.3 skill do?

Ensure that the --use-service-account-credentials argument is set to true (Automated) It is listed under DevOps & Infra on SkillMD.

Is Cis K8S V1120 1.3.3 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis K8S V1120 1.3.3?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis K8S V1120 1.3.3 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis K8S V1120 1.3.3?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis K8S V1120 1.3.3 by cyberstrikeus

Name: Cis K8S V1120 1.3.3
Author: cyberstrikeus

File contents

CIS Kubernetes Benchmark v1.12.0 - Control 1.3.3

Profile Applicability

Level: 1 - Master Node

Description

Use individual service account credentials for each controller.

Rationale

The controller manager creates a service account per controller in the kube-system namespace, generates a credential for it, and builds a dedicated API client with that service account credential for each controller loop to use. Setting the --use-service-account-credentials to true runs each control loop within the controller manager using a separate service account credential. When used in combination with RBAC, this ensures that the control loops run with the minimum permissions required to perform their intended tasks.

Impact

Whatever authorizer is configured for the cluster, it must grant sufficient permissions to the service accounts to perform their intended tasks. When using the RBAC authorizer, those roles are created and bound to the appropriate service accounts in the kube-system namespace automatically with default roles and rolebindings that are auto-reconciled on startup.

If using other authorization methods (ABAC, Webhook, etc), the cluster deployer is responsible for granting appropriate permissions to the service accounts (the required permissions can be seen by inspecting the controller-roles.yaml and controller-role-bindings.yaml files for the RBAC roles.

Audit Procedure

Run the following command on the Control Plane node:

ps -ef | grep kube-controller-manager

Verify that the --use-service-account-credentials argument is set to true.

Remediation

Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the Control Plane node to set the below parameter.

--use-service-account-credentials=true

Default Value

By default, --use-service-account-credentials is set to false.

References

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	5.2 Use Unique Passwords
v8	6.8 Define and Maintain Role-Based Access Control
v7	4.4 Use Unique Passwords

Profile

Level 1 - Master Node (Automated)

---name: cis-k8s-v1120-1-3-3description: Ensure that the --use-service-account-credentials argument is set to true (Automated)---# CIS Kubernetes Benchmark v1.12.0 - Control 1.3.3## Profile Applicability- **Level:** 1 - Master Node## DescriptionUse individual service account credentials for each controller.## RationaleThe controller manager creates a service account per controller in the `kube-system` namespace, generates a credential for it, and builds a dedicated API client with that service account credential for each controller loop to use. Setting the `--use-service-account-credentials` to `true` runs each control loop within the controller manager using a separate service account credential. When used in combination with RBAC, this ensures that the control loops run with the minimum permissions required to perform their intended tasks.## ImpactWhatever authorizer is configured for the cluster, it must grant sufficient permissions to the service accounts to perform their intended tasks. When using the RBAC authorizer, those roles are created and bound to the appropriate service accounts in the `kube-system` namespace automatically with default roles and rolebindings that are auto-reconciled on startup.If using other authorization methods (ABAC, Webhook, etc), the cluster deployer is responsible for granting appropriate permissions to the service accounts (the required permissions can be seen by inspecting the `controller-roles.yaml` and `controller-role-bindings.yaml` files for the RBAC roles.## Audit ProcedureRun the following command on the Control Plane node:```bashps -ef | grep kube-controller-manager```Verify that the `--use-service-account-credentials` argument is set to `true`.## RemediationEdit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` on the Control Plane node to set the below parameter.```--use-service-account-credentials=true```## Default ValueBy default, `--use-service-account-credentials` is set to false.## References1. https://kubernetes.io/docs/admin/kube-controller-manager/2. https://kubernetes.io/docs/admin/service-accounts-admin/3. https://github.com/kubernetes/kubernetes/blob/release-1.6/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml4. https://github.com/kubernetes/kubernetes/blob/release-1.6/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-role-bindings.yaml5. https://kubernetes.io/docs/admin/authorization/rbac/#controller-roles## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | ------------------------------------------------- | ---- | ---- | ---- || v8 | 5.2 Use Unique Passwords | | | || v8 | 6.8 Define and Maintain Role-Based Access Control | | | || v7 | 4.4 Use Unique Passwords | | | |## Profile**Level 1 - Master Node** (Automated)

Frequently asked questions

Cis K8S V1120 1.3.3