A Kubernetes service account (KSA) is a namespace-scoped identity used to authenticate cluster access and authorize operations through Kubernetes RBAC. It differs from a Google service account, which supplies Google Cloud permissions for cluster registration, connectivity, or operations data. section 2.7 section 17.3.5
Use distinct accounts and explicit bindings for these responsibilities:
- Create a KSA in the target namespace for token-based cluster login. section 2.7
- Bind the KSA to the view role for read-only access and to cloud-console-reader for console resource visibility. section 2.7
- Assign separate Google service accounts to cluster registration, the Connect Agent, and logging and monitoring where required. section 17.3.5
Create a console-login identity
Set KSA_NAME, create the account, and bind the required ClusterRoles: kubectl create serviceaccount ${KSA_NAME}; kubectl create clusterrolebinding VIEW_BINDING --clusterrole view --serviceaccount default:${KSA_NAME}; kubectl create clusterrolebinding CONSOLE_BINDING --clusterrole cloud-console-reader --serviceaccount default:${KSA_NAME}. A token can then be read from the account's Secret for token authentication. section 2.7
apiVersion: v1 kind: Config users: - name: svcs-acct-dply user: token: <replace this with token info> clusters: - cluster: certificate-authority-data: <replace this with certificate-authority-data info> server: <replace this with server info> name: self-hosted-cluster contexts: - context: cluster: self-hosted-cluster user: svcs-acct-dply name: svcs-acct-context current-context: svcs-acct-context
Inspect a kubeconfig template that uses a service-account token, cluster certificate data, and server information to connect to an external cluster. section 5.3
