What are Service Accounts?#

In Kubernetes, there are two types of accounts:

1. User Accounts: Used by humans (admins, developers, operators)
2. Service Accounts: Used by processes running in pods to interact with the Kubernetes API

Service Accounts are crucial for applications running within your cluster that need to interact with the Kubernetes API or other services.

Creating and Managing Service Accounts#

Let’s start with the basics:

1
kubectl create serviceaccount my-app-sa

1
kubectl get serviceaccounts
2
# or
3
kubectl get sa

Hands-on: Using Service Accounts with RBAC#

Let’s walk through a practical example of creating and using a Service Account with RBAC.

1
kubectl create serviceaccount pod-reader-sa

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: Role
3
metadata:
4
  namespace: default
5
  name: pod-reader
6
rules:
7
  - apiGroups: [""]
8
    resources: ["pods"]
9
    verbs: ["get", "watch", "list"]

1
kubectl apply -f pod-reader-role.yaml

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: RoleBinding
3
metadata:
4
  name: read-pods
5
  namespace: default
6
subjects:
7
  - kind: ServiceAccount
8
    name: pod-reader-sa
9
    namespace: default
10
roleRef:
11
  kind: Role
12
  name: pod-reader
13
  apiGroup: rbac.authorization.k8s.io

1
kubectl apply -f pod-reader-rolebinding.yaml

1
apiVersion: v1
2
kind: Pod
3
metadata:
4
  name: pod-reader-pod
5
spec:
6
  serviceAccountName: pod-reader-sa
7
  containers:
8
    - name: my-container
9
      image: busybox
10
      command: ["sh", "-c", "while true; do kubectl get pods; sleep 10; done"]

1
kubectl apply -f pod-reader-pod.yaml

Key Takeaways#

1. Automation-Friendly: Service Accounts are ideal for automated processes and applications running in your cluster.
2. Namespace Scoped: Unlike ClusterRoles, Service Accounts are namespace-specific.
3. Default Service Account: Each namespace has a default Service Account, but it’s best practice to create specific ones for your applications.
4. Token Authentication: Service Accounts use tokens for authentication, which are automatically mounted into pods.
5. RBAC Integration: Service Accounts can be bound to Roles or ClusterRoles just like user accounts.

Best Practices#

1. Least Privilege: Always grant the minimum necessary permissions to your Service Accounts.
2. Unique Accounts: Create separate Service Accounts for different applications or components.
3. Regular Audits: Periodically review your Service Accounts and their permissions.
4. Avoid Using Default: Don’t rely on the default Service Account; create specific ones for your needs.
5. Rotate Tokens: Regularly rotate Service Account tokens for enhanced security.

Conclusion#

Service Accounts are a fundamental part of Kubernetes security and RBAC. They allow you to grant specific permissions to processes running within your cluster, enabling secure interactions between your applications and the Kubernetes API. By understanding and properly implementing Service Accounts, you can significantly enhance the security posture of your Kubernetes deployments.

This blog post template provides a comprehensive look at Service Accounts in Kubernetes, based on the task you described. It includes practical examples, explanations of key concepts, and important takeaways. The content is structured to be both informative and hands-on, suitable for readers who want to understand and implement Service Accounts in their Kubernetes environments.