Service Accounts

kubernetes kubernetes/kcna

Service Accounts | Kubernetes
Kubernetes Service Accounts: A Practical Guide | overcast blog

Core Idea

A service account is the API identity for workloads running in pods: the account authenticates, and RBAC bound to it decides which resources the workload may touch.

• Kubernetes resource that gives pods an identity, as the note’s quote puts it.
• RBAC applies to service accounts to control access through the Kubernetes API.
• Covered practically: use cases and how to create a service account.

Quote

Service accounts are Kubernetes resources that provide an identity to workloads that run inside Pods.
RBAC can be applied to service accounts to control what resources, via the Kubernetes API, the identity has access to.
If your application doesn’t require access to the Kubernetes API, you should disable access following the least privilege principal.
By default, Kubernetes creates a default service account in each namespace, which is automatically set as the service account for all Pods. This service account contains a token that is automounted in each Pod and is used to access the Kubernetes API.
To disable this behavior, you must add automountServiceAccountToken: false to the service account configuration.

‘Service Account Management’
—Brendan Burns, “Kubernetes: Up and Running”

A service account is a type of non-human account that, in K8s, provides a distinct identity in a K8s cluster.
Application Pods, system components, and entities inside and outside the cluster can use a specific ServiceAccount’s credentials to identify as that ServiceAccount.
This identity is useful in various situations, including authenticating to the API server or implementing identity-based security policies.

• Managed by Kubernetes.
• Used for applications inside the cluster.
• Automatically assigned to pods.
• Scoped to a namespace.
• Uses tokens for authentication.

Every namespace has a default service account. If no service account is specified, Kubernetes assigns the default service account.

Use Cases

• Automated Application deployment
• Monitoring & Logging
• Inter Service communication

Creating Service Account

apiVersion: v1  
kind: ServiceAccount  
metadata:  
  name: example-serviceaccount