0Pricing
DevOps Bootcamp · Lesson

Service Accounts and Workload Identity

Learn how Service Accounts give Pods their own identity, how their tokens work, and how to grant them least-privilege access.

Service Accounts and Workload Identity is a free DevOps Bootcamp lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Identity for Workloads

Users authenticate to Kubernetes, but Pods need an identity too, so they can talk to the API server safely. That identity is a Service Account.

What Is a Service Account?

A ServiceAccount is a namespaced object that represents the identity of a workload. Every Pod runs under one, defaulting to default if you do not specify.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: report-generator
  namespace: analytics

Assigning a Service Account to a Pod

Set serviceAccountName in the Pod spec to run under a specific identity.

apiVersion: v1
kind: Pod
metadata:
  name: reporter
spec:
  serviceAccountName: report-generator
  containers:
  - name: app
    image: reporter:1.0

The Mounted Token

Kubernetes mounts a short-lived JWT token for the Service Account into the Pod, used to authenticate API calls.

# inside the Pod
cat /var/run/secrets/kubernetes.io/serviceaccount/token

Why the Default Account Is Risky

The default ServiceAccount is shared by all Pods in a namespace. Granting it permissions would over-expose everything. Prefer a dedicated account per workload.

Disabling Token Auto-Mount

If a Pod never calls the API, disable token mounting to shrink the attack surface.

apiVersion: v1
kind: Pod
metadata:
  name: no-api-pod
spec:
  automountServiceAccountToken: false
  containers:
  - name: app
    image: myapp:1.0

Granting Permissions with RBAC

A Service Account has no power until you bind it to a Role. The RoleBinding subject is the Service Account.

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: reporter-read
  namespace: analytics
subjects:
- kind: ServiceAccount
  name: report-generator
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Least Privilege in Practice

  • One Service Account per workload
  • Grant only the verbs and resources it truly needs
  • Scope to a namespace with Role when possible, not ClusterRole

Bound, Projected Tokens

Modern tokens are projected and bound to the Pod's lifetime with a short expiry. They auto-rotate, so a leaked token is far less dangerous than the old long-lived secrets.

Workload Identity in the Cloud

Cloud platforms map a Kubernetes ServiceAccount to a cloud IAM identity (e.g. IRSA on AWS, Workload Identity on GKE), so Pods access cloud resources without storing static credentials.

metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123:role/report-role

Verifying Permissions

Use kubectl auth can-i impersonating the Service Account to confirm it has exactly the access you expect.

kubectl auth can-i list pods \
  --as=system:serviceaccount:analytics:report-generator \
  -n analytics

Quick Check

Test your understanding of Service Accounts.

Recap

You learned that a ServiceAccount gives a Pod its own identity, backed by short-lived projected tokens. Apply least privilege with a dedicated account per workload, grant access via RBAC bindings, disable token mounts when unused, and map accounts to cloud IAM for credential-free access.

Frequently asked questions

Is the “Service Accounts and Workload Identity” lesson free?

Yes — the full text of “Service Accounts and Workload Identity” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.

What will I learn in “Service Accounts and Workload Identity”?

Learn how Service Accounts give Pods their own identity, how their tokens work, and how to grant them least-privilege access. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Service Accounts and Workload Identity” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Role-Based Access Control (RBAC)
  2. Network Policies for Isolation
  3. Pod Security Standards
  4. Service Accounts and Workload Identity
← Back to DevOps Bootcamp