What Is a Kubernetes Service Account Token and How Does It Work?

# See service accounts in a namespace
kubectl get serviceaccounts -n production
 
# Describe a specific one
kubectl describe serviceaccount my-app -n production

# Inside a pod
cat /var/run/secrets/kubernetes.io/serviceaccount/token

# From inside a pod, calling the Kubernetes API directly
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -H "Authorization: Bearer $TOKEN" \
     --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
     https://kubernetes.default.svc/api/v1/namespaces/default/configmaps

# Old style — auto-created Secret for service account
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
  name: my-app-token
  annotations:
    kubernetes.io/service-account.name: my-app

volumes:
- name: kube-api-access
  projected:
    sources:
    - serviceAccountToken:
        expirationSeconds: 3607
        path: token
    - configMap:
        name: kube-root-ca.crt
        items:
        - key: ca.crt
          path: ca.crt
    - downwardAPI:
        items:
        - path: namespace
          fieldRef:
            fieldPath: metadata.namespace

# 1. Create a Role with specific permissions
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: configmap-reader
  namespace: production
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "watch"]
---
# 2. Bind the Role to a ServiceAccount
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-configmaps
  namespace: production
subjects:
- kind: ServiceAccount
  name: my-app
  namespace: production
roleRef:
  kind: Role
  name: configmap-reader
  apiGroup: rbac.authorization.k8s.io
---
# 3. Use the ServiceAccount in your Pod
apiVersion: v1
kind: Pod
spec:
  serviceAccountName: my-app
  containers:
  - name: app
    image: myapp:latest

# 1. Create an IAM role with a trust policy for the service account
aws iam create-role \
  --role-name my-app-role \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/EXAMPLE"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLE:sub": 
            "system:serviceaccount:production:my-app"
        }
      }
    }]
  }'
 
# 2. Annotate the service account with the role ARN
kubectl annotate serviceaccount my-app \
  -n production \
  eks.amazonaws.com/role-arn=arn:aws:iam::123456789:role/my-app-role

# Check if service account has the right role binding
kubectl auth can-i list pods \
  --as=system:serviceaccount:production:my-app \
  -n production
 
# Check what the service account can do
kubectl auth can-i --list \
  --as=system:serviceaccount:production:my-app \
  -n production

# Check the service account annotation
kubectl describe serviceaccount my-app -n production | grep eks.amazonaws.com
 
# Check if the projected token has the right audience
# Inside the pod:
cat /var/run/secrets/eks.amazonaws.com/serviceaccount/token | \
  python3 -c "import sys,json,base64; t=sys.stdin.read().split('.')[1]; print(json.loads(base64.b64decode(t+'==')))"
# Look for "aud": ["sts.amazonaws.com"]

spec:
  automountServiceAccountToken: false  # More secure for pods that don't need it
  containers:
  - name: app
    image: myapp:latest