A security token is a credential value that authenticates a client or workload to the Kubernetes API. Service Accounts provide tokens for machines and pods, while RBAC roles and bindings limit what those identities can do. section 3.4 section 3.3
Use these operational rules when working with tokens:
- Kubernetes automatically creates a default Service Account in each namespace and mounts its API credential into pods unless mounting is disabled. section 3.3
- Modern clusters obtain API credentials through the TokenRequest API and mount them with a projected volume; older clusters used long-term token Secrets. section 3.3 section 3.3
- Treat tokens as sensitive credentials because they can authenticate from outside the cluster; grant only the required permissions through roles and role bindings. section 3.3 section 3.3
Grant and verify limited pod access
Create a role with kubectl create role pod-list --verb=list --resource=pods, bind it to a Service Account, then verify access with kubectl auth can-i list pods --as system:serviceaccount:default:nomount-sa.
