How do I install the Cis Oke V170 4.1.5 skill?

Run npx skillmds@latest add cyberstrikeus/cis-oke-v170-4-1-5 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis Oke V170 4.1.5 skill do?

Ensure that default service accounts are not actively used (Automated) It is listed under DevOps & Infra on SkillMD.

Is Cis Oke V170 4.1.5 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis Oke V170 4.1.5?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis Oke V170 4.1.5 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis Oke V170 4.1.5?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis Oke V170 4.1.5 by cyberstrikeus

Name: Cis Oke V170 4.1.5
Author: cyberstrikeus

File contents

CIS OKE Benchmark v1.7.0 - Control 4.1.5

Profile Applicability

Level: 1

Description

The default service account should not be used to ensure that rights granted to applications can be more easily audited and reviewed.

Rationale

Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod.

Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account.

The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments.

Impact

All workloads which require access to the Kubernetes API will require an explicit service account to be created.

Audit Procedure

For each namespace in the cluster, review the rights assigned to the default service account and ensure that it has no roles or cluster roles bound to it apart from the defaults.

Additionally ensure that the automountServiceAccountToken: false setting is in place for each default service account.

Check for automountServiceAccountToken using:

export SERVICE_ACCOUNT=<service account name>
kubectl get serviceaccounts/$SERVICE_ACCOUNT -o yaml

Remediation

Create explicit service accounts wherever a Kubernetes workload requires specific access to the Kubernetes API server. Modify the configuration of each default service account to include this value:

automountServiceAccountToken: false

Automatic remediation for the default account:

kubectl patch serviceaccount default -p $'automountServiceAccountToken: false'

Default Value

By default the default service account allows for its service account token to be mounted in pods in its namespace.

References

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	5.3 Disable Dormant Accounts	*	*	*
v7	16.9 Disable Dormant Accounts	*	*	*

MITRE ATT&CK Mappings

Techniques / Sub-techniques	Tactics	Mitigations
T1552	TA0006	M1028

Profile

Level 1 (Automated)

---name: cis-oke-v170-4-1-5description: Ensure that default service accounts are not actively used (Automated)---# CIS OKE Benchmark v1.7.0 - Control 4.1.5## Profile Applicability- **Level:** 1## DescriptionThe `default` service account should not be used to ensure that rights granted to applications can be more easily audited and reviewed.## RationaleKubernetes provides a `default` service account which is used by cluster workloads where no specific service account is assigned to the pod.Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account.The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments.## ImpactAll workloads which require access to the Kubernetes API will require an explicit service account to be created.## Audit ProcedureFor each namespace in the cluster, review the rights assigned to the default service account and ensure that it has no roles or cluster roles bound to it apart from the defaults.Additionally ensure that the `automountServiceAccountToken: false` setting is in place for each default service account.Check for automountServiceAccountToken using:```bashexport SERVICE_ACCOUNT=<service account name>kubectl get serviceaccounts/$SERVICE_ACCOUNT -o yaml```## RemediationCreate explicit service accounts wherever a Kubernetes workload requires specific access to the Kubernetes API server. Modify the configuration of each default service account to include this value:```automountServiceAccountToken: false```Automatic remediation for the default account:```bashkubectl patch serviceaccount default -p $'automountServiceAccountToken: false'```## Default ValueBy default the `default` service account allows for its service account token to be mounted in pods in its namespace.## References1. https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/2. https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | ----------------------------- | ---- | ---- | ---- || v8 | 5.3 Disable Dormant Accounts | \* | \* | \* || v7 | 16.9 Disable Dormant Accounts | \* | \* | \* |## MITRE ATT&CK Mappings| Techniques / Sub-techniques | Tactics | Mitigations || --------------------------- | ------- | ----------- || T1552 | TA0006 | M1028 |## Profile**Level 1** (Automated)

Frequently asked questions

Cis Oke V170 4.1.5