What is Kubernetes Service Account?

Question

Accepted Answer

**ServiceAccount** — identity for Pods to authenticate with the API server.

```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: myapp-sa
  namespace: production
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789:role/myapp-role
automountServiceAccountToken: true
---
# Deployment using ServiceAccount
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  template:
    spec:
      serviceAccountName: myapp-sa
      automountServiceAccountToken: false  # Don't mount token
      containers:
      - name: app
        image: myapp:latest
---
# RoleBinding for ServiceAccount
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: myapp-binding
  namespace: production
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-reader
subjects:
- kind: ServiceAccount
  name: myapp-sa
  namespace: production
```

```bash
# Commands
kubectl get sa -n production
kubectl create sa myapp-sa -n production
kubectl get secret -n production  # Auto-created token
kubectl describe sa myapp-sa -n production

# AWS IAM integration (IRSA)
eksctl create iamserviceaccount \
  --name myapp-sa \
  --namespace production \
  --cluster mycluster \
  --role-name myapp-role \
  --attach-policy-arn arn:aws:iam::policy/MyPolicy
```

**Cloud Integrations:**
- AWS: IRSA (IAM Roles for Service Accounts).
- GCP: Workload Identity.
- Azure: Azure AD Workload Identity.

DevOps: What is Kubernetes Service Account?