A Kubernetes service account is an identity used to authenticate with the Kubernetes API and access or manage cluster resources. Kubernetes uses service accounts instead of traditional user accounts. Permissions belong to the account, so a newly provisioned root account can have unrestricted cluster access and must be treated as sensitive. section 8.1.3 section 8.6
Using a service account with kubectl requires:
- A valid service account with appropriate permissions. section 8.5.2
- A kubeconfig file containing the account’s sensitive access information. section 8.1.3
- kubectl configured to use that kubeconfig when managing the cluster. section 8.1.3 section 8.6
GitHub Actions deployment
A deployment workflow stores the service account’s kubeconfig as the KUBECONFIG_SA secret, writes it to ~/.kube/config, verifies access with kubectl get pods and kubectl get deployments, applies manifests, and restarts deployments. Keep infrastructure automation separate from application repositories when practical, and never commit kubeconfig credentials to Git. section 8.5.2 section 8.1.3
