Kubernetes Clusters Should Disable Automounting API Credentials

Description:

Disable automounting API credentials to prevent a potentially compromised Pod resource to run API commands against Kubernetes clusters. 

Solution/Reference: 

From the unhealthy resources tab, select the cluster. Security Center lists the pods missing the automountServiceAccountToken: false flag. There are multiple ways to opt out of automounting API credentials for a service account. To opt out of automounting API credentials for a single pod, set automountServiceAccountToken: false in PodSpec. After making your changes, redeploy your updated pod or service account.

For more information, see https://aka.ms/kubepolicydoc.