Kubernetes service account

• Managing Service Accounts (ref)
• Configure Service Accounts for Pods (ref)
• Using RBAC Authorization (ref)

system:serviceaccount: (singular) is the prefix for service account usernames.
system:serviceaccounts: (plural) is the prefix for service account groups.

• kind: ServiceAccount
• kubernetes.io/service-account-token
• My-first-chart/templates/serviceaccount.yaml

Commands

• kubectl get serviceaccounts, kubectl get sa
  • kubectl get sa -n kube-system
• kubectl create serviceaccount, kubectl create sa
• kubectl describe sa
• kubectl patch serviceaccount

Helm v2 (deprecated)

• helm init --stable-repo-url=https://charts.helm.sh/stable --service-account tiller --tiller-image ghcr.io/helm/tiller:v2.16.1

Errors

• Error creating: pods "your_pod" is forbidden: error looking up service account default/your_service_account: serviceaccount "your_service_account" not found
• Error from server (InternalError): an error on the server ("unable to create impersonator account: error getting service account token: service account is not ready") has prevented the request from succeeding

Changelog

• Conflicting issuers between JWT authenticators and service account config are now detected and fail on API server startup.

News

• v1.31 Bound service account token improvement (ServiceAccountTokenNodeBinding)

Related

• Terraform Kubernetes resource: kubernetes_service_account
• Google Cloud Service account
• Helm: My-first-chart/templates/serviceaccount.yaml
• Kubernetes roles
• Token: aws eks get-token
• Kubernetes controller manager
• BoundServiceAccountTokenVolume
• ServiceAccount admission controller: /var/run/secrets/kubernetes.io/serviceaccount
• default
• kubectl describe clusterrolebindings
• Kubernetes users, Kubernetes groups

Activities

• Read AWS documentation: https://docs.aws.amazon.com/eks/latest/userguide/service-accounts.html
• Configuring Pods to use a Kubernetes service account

See also

• Kubernetes service account, ServiceAccount:, kubectl get serviceaccounts, kubectl create serviceaccount, kubectl describe serviceaccount, kubernetes.io/service-account-token, Kubernetes users, Kubernetes groups, Kubernetes roles, ServiceAccountTokenNodeBinding
• Kubernetes Authentication, bearer tokens, certificate authentication, Service accounts, CertificateSigningRequest, aws-auth, EKS Authentication, kind: Config, gke-gcloud-auth-plugin
• Kubernetes RBAC kubectl auth, kubectl auth can-i, kubectl auth reconcile kubectl create [ role | clusterrole | clusterrolebinding | rolebinding | serviceaccount ], groups:, Kubernetes RBAC good practices, kube2iam, K8s Cluster roles, rbac.authorization.k8s.io, system:, kind: AuthorizationConfiguration, aws-auth for EKS, kind: Role, SelfSubjectReviews, Impersonation
• Kubernetes users, Kubernetes groups, Kubernetes roles, Kubernetes service accounts

https://kubernetes.io/blog/2024/08/13/kubernetes-v1-31-release/#bound-service-account-token-improvements