A service account is a namespace-scoped Kubernetes resource that gives a workload an identity for authenticating to the Kubernetes API. Unlike a human user, it is managed as a Kubernetes object. Pods can use service-account tokens to authenticate; roles and role bindings determine what that identity may do. Give workloads only the permissions they need. section 3.1 section 3.3
Check the identity and its credentials separately:
- Create a namespace, then run `kubectl get sa -n web`: a `default` service account is created automatically. A pod uses that account unless another is specified with `serviceAccountName`. section 3.3
- Inspect a pod with `kubectl get po nginx -o yaml`. Its service-account access appears as a read-only mount at `/var/run/secrets/kubernetes.io/serviceaccount`. Recent Kubernetes versions obtain credentials through the TokenRequest API and mount them using a projected volume, rather than automatically creating long-lived token Secrets. section 3.3
- If a pod does not need API access, set `automountServiceAccountToken: false` on its service account or in its pod specification. Then inspect the pod YAML to verify that no service-account volume mount appears. section 3.3
root@kind-control-plane:/# kubectl get po nginx -o yaml |
grep volumeMounts -A14
volumeMounts:
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
name: kube-api-access-nhxf2
readOnly: true
dnsPolicy: ClusterFirst
enableServiceLinks: true
nodeName: kind-worker2
preemptionPolicy: PreemptLowerPriority
priority: 0
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
serviceAccount: default
serviceAccountName: default
terminationGracePeriodSeconds: 30
The pod YAML shows both `serviceAccountName: default` and the read-only API-access volume mount. Check both fields when verifying which identity a pod uses and whether its token is mounted. section 3.3
Grant and test a narrow permission
Create a role with `kubectl create role pod-list --verb=list --resource=pods`, then bind it with `kubectl create rolebinding pod-list-bind --role=pod-list --serviceaccount=default:nomount-sa`. Verify authorization using `kubectl auth can-i list pods --as system:serviceaccount:default:nomount-sa`. A `yes` confirms that RBAC permits this identity to list pods; it does not mean a pod with token automount disabled has a token available to make the request. section 3.3
