Azure Defender alert on Kubernetes clusters should disable automounting API credentials

[kumachop2]

I tried opt out of automounting API credentials on /var/run/secrets/kubernetes.io/serviceaccount/token for a service account by setting automountServiceAccountToken: false on the ServiceAccount:

experiencing below exception:

3:48
Error: failed build extensions: failed to create extension "k8s_observer": open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory
2022/08/10 19:30:53 main.go:143: application run finished with error: failed build extensions: failed to create extension "k8s_observer": open /var/run/secrets/kubern
etes.io/serviceaccount/token: no such file or directory

[atoulme]

I'm not sure how to best help you. Is this a report for https://github.com/signalfx/splunk-otel-collector-chart?

[kumachop2]

Using helm for setup, hence I thought it associated here. issue resolved with alternate approach and I'm good for now. But I would recommend team to provide suitable approach to remediate Azure Defender vulnerability on automounting API credentials

[atoulme]

Thanks! What alternate approach did you take?

[kumachop2]

Created service account, bind and mapped the access token. Disabled the service account creation with helm install