Kubernetes knob to control mounting of k8s service account to a POD

Introduction

Laymen explanation

If you need to provide permissions to a Kubernetes POD, you must have explored service account feature, In this case, you may see that there is a file mount in POD which provides corresponding JWT token. Even if you donot use service account, you will see such file mount. You may be wondering why so? This document helps in this direction.

Technical explanation

A ServiceAccount is used by containers running in a Pod, to communicate with the API server of the Kubernetes cluster. If the pod does not have a ServiceAccount set, it sets the ServiceAccount to default.

Most applications don’t need to talk to the API server, so they don’t need an access token. This is especially important if you’re not using RBAC. You can do this by specifying a knob.

Example for try

Please refer here for the example YAML. Notice the option automountServiceAccountToken

Precedence rule

This option can be provided in service account and/or POD definition. In case it is provided at both place, then POD definition configuration will be applied.

Reference

https://unofficial-kubernetes.readthedocs.io/en/latest/tasks/configure-pod-container/configure-service-account/

https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/

https://www.oreilly.com/library/view/kubernetes-security/9781492039075/ch04.html