Working with Service Accounts

1. Creating Service Account

Field	Description	Example
apiVersion	API version to use	`v1`
kind	Resource type	`ServiceAccount`
metadata.name	Name of the service account	`my-service-account`
metadata.namespace	Namespace to create the service account in	`default`

Example: Creating a Service Account

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
  namespace: default

Note: Service accounts are automatically created with a secret token in Kubernetes 1.24+.

2. Listing Service Accounts

Field	Description	Example Value
metadata.name	Name of the service account	`default`
metadata.namespace	Namespace where the service account resides	`default`
secrets	List of secrets bound to the service account	`[{name: "default-token-xyz123"}]`

Example: List Service Accounts in a Namespace

kubectl get serviceaccounts -n <namespace>

Example: List All Service Accounts Across Namespaces

kubectl get serviceaccounts --all-namespaces

Note: By default, every namespace in Kubernetes has a default service account.

3. Describing Service Account Details

Property	Description	Example Value
metadata.name	Name of the ServiceAccount	`default`
metadata.namespace	Namespace where the ServiceAccount resides	`default`
secrets	List of secrets bound to the ServiceAccount	`[{name: "default-token-xyz123"}]`
imagePullSecrets	References to secrets for pulling images from private registries	`[{name: "my-registry-secret"}]`
automountServiceAccountToken	Whether to automatically mount the service account token	`true`

Example: Describe Service Account

kubectl describe serviceaccount default -n default

Example: Get Service Account as YAML

apiVersion: v1
kind: ServiceAccount
metadata:
  name: default
  namespace: default
secrets:
- name: default-token-xyz123
imagePullSecrets: []
automountServiceAccountToken: true

4. Using Service Account in Pod

Property	Description	Default Value
serviceAccountName	Name of the ServiceAccount to use for the Pod	default
automountServiceAccountToken	Whether to automatically mount the ServiceAccount token	true

Example: Using Service Account in Pod

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  serviceAccountName: my-service-account
  automountServiceAccountToken: true
  containers:
  - name: app
    image: my-app:latest

Note: The ServiceAccount token is mounted at /var/run/secrets/kubernetes.io/serviceaccount inside the Pod.

Warning: Ensure that the ServiceAccount has appropriate RBAC permissions for the Pod's operations.

5. Understanding Default Service Account

Property	Value	Description
name	`default`	Default service account name in each namespace
automount	`true`	Automatically mount tokens and CA certificates for pods
permissions	`limited`	Minimal RBAC permissions by default

Example: Pod using default service account

apiVersion: v1
kind: Pod
metadata:
  name: example-pod
spec:
  serviceAccountName: default
  containers:
  - name: app-container
    image: nginx

Note: The default service account in each namespace has minimal permissions and is intended for basic use cases. For enhanced security, create custom service accounts with specific RBAC rules.

6. Configuring Automount Token

Field	Description	Default Value	Notes
automountServiceAccountToken	Controls whether a service account token is automatically mounted	`true`	Set to `false` to disable automatic mounting

Example: Disabling Automount Token

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-sa
automountServiceAccountToken: false

Note: When automountServiceAccountToken is set to false, the service account token will not be automatically mounted in pods using this service account. You must manually mount it if needed.

7. Creating Service Account Token

Field	Description	Example
metadata.name	Name of the ServiceAccount	`my-service-account`
metadata.namespace	Namespace where the ServiceAccount resides	`default`
secrets	List of secrets associated with the ServiceAccount	`[{name: "my-service-account-token-xyz123"}]`

Example: Create ServiceAccount with Token

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
  namespace: default

Example: Create Token Secret for ServiceAccount

apiVersion: v1
kind: Secret
metadata:
  name: my-service-account-token
  namespace: default
  annotations:
    kubernetes.io/service-account.name: my-service-account
type: kubernetes.io/service-account-token

Note: The token secret must be created in the same namespace as the ServiceAccount.

Warning: Ensure that the ServiceAccount has appropriate RBAC permissions to access required resources.

8. Using Bound Service Account Tokens

Field	Description	Values
audience	Intended audience for the token	`default`
expirationSeconds	Duration in seconds for token validity	`3600`
boundObjectRef	Reference to the object the token is bound to	`{ kind: "Pod", name: "my-pod" }`

Example: Creating a Bound Token

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-sa
  namespace: default
secrets:
- name: my-sa-token

Example: Using Bound Token in Pod

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  serviceAccountName: my-sa
  containers:
  - name: app
    image: nginx
    env:
    - name: KUBE_TOKEN
      valueFrom:
        fieldRef:
          fieldPath: metadata.annotations['token']

Note: Bound service account tokens are automatically rotated by the API server.

Warning: Ensure that the service account has appropriate RBAC permissions to access required resources.

9. Configuring Token Expiration

Field	Description	Default Value	Notes
automountServiceAccountToken	Controls whether a service account token is automatically mounted in pods.	`true`	Set to `false` to disable automatic mounting.
tokenExpirationSeconds	Duration in seconds for which the service account token is valid.	`3600`	Maximum value is `86400` (24 hours). Requires API server configuration.

Example: Setting Token Expiration in ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: example-sa
  namespace: default
automountServiceAccountToken: true
secrets:
- name: example-sa-token-xyz123

Note: Token expiration is managed by the API server and requires appropriate RBAC permissions to configure.

Warning: Setting tokenExpirationSeconds to a very low value may cause frequent token refreshes, leading to performance issues.

10. Deleting Service Accounts

Property	Description	Example
serviceAccount.name	Name of the Service Account to delete	`my-service-account`
namespace	Namespace where the Service Account resides	`default`

Example: Delete Service Account

kubectl delete serviceaccount my-service-account -n default

Note: Deleting a Service Account will also remove all associated secrets and tokens.

Warning: Ensure no pods or deployments are using the Service Account before deletion.