Working with Service Accounts
1. Creating Service Account
kubectl create sa app-sa
kubectl create sa app-sa -n payments
apiVersion: v1
kind: ServiceAccount
metadata:
name: app-sa
namespace: payments
annotations:
eks.amazonaws.com/role-arn: arn:aws:iam::111:role/app
automountServiceAccountToken: false
2. Listing Service Accounts
kubectl get sa
kubectl get sa -A
kubectl get sa app-sa -o yaml
| Column | Meaning |
|---|
| SECRETS | Legacy auto-mounted token secret count (1.24-) |
| AGE | Creation time |
3. Describing Service Account Details
| Field | Info |
|---|
| Tokens | Bound tokens (1.24+, projected, not Secret) |
| Image pull secrets | Auto-injected to pods |
| Mountable secrets | Allowed for pods (security) |
4. Using Service Account in Pod
spec:
serviceAccountName: app-sa
automountServiceAccountToken: true
| Effect | Detail |
|---|
| Mounts | /var/run/secrets/kubernetes.io/serviceaccount/ |
| Files | token, ca.crt, namespace |
5. Understanding Default Service Account
| Detail | Value |
|---|
| Name | default (auto-created per namespace) |
| Permissions | None by default |
| Used when | Pod omits serviceAccountName |
6. Configuring Automount Token
| Location | Precedence |
|---|
| SA spec | Default for all pods using SA |
| Pod spec | Overrides SA setting |
Note: Disable token mount for workloads that don't call the API to reduce blast radius.
7. Creating Service Account Token
kubectl create token app-sa --duration=1h
kubectl create token app-sa --audience=vault --bound-object-kind=Pod --bound-object-name=web-abc
| Flag | Effect |
|---|
--duration | TTL (default 1h, max from apiserver flag) |
--audience | Token audience (for OIDC/Vault) |
--bound-object-* | Token invalid when object deleted |
8. Using Bound Service Account Tokens
volumes:
- name: sa-token
projected:
sources:
- serviceAccountToken:
audience: vault
expirationSeconds: 3600
path: token
| Property | Detail |
|---|
| Bound to | Pod (auto-rotated, invalidated on delete) |
| Audience | Restricts token validity |
| Stable | Default since 1.21 |
9. Configuring Token Expiration
| Where | Setting |
|---|
| Pod projection | expirationSeconds (min 600) |
| kubectl create token | --duration |
| API server | --service-account-max-token-expiration |
10. Deleting Service Accounts
Warning: Deleting an SA invalidates pods' tokens at next rotation; pods using API calls will fail.