Service accounts in Kubernetes - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a Service Account in Kubernetes?

A Service Account in Kubernetes is a special type of account used by applications running in pods to interact with the Kubernetes API securely without using a user's credentials.

beginner

How does a Service Account differ from a regular user account in Kubernetes?

Service Accounts are meant for processes running inside pods, while user accounts are for humans. Service Accounts are managed by Kubernetes and provide tokens automatically to pods.

beginner

What is the default Service Account in a Kubernetes namespace?

Every Kubernetes namespace has a default Service Account named 'default'. Pods that do not specify a Service Account use this one automatically.

intermediate

How do you assign a specific Service Account to a pod?

You specify the Service Account name in the pod's YAML file under the 'serviceAccountName' field in the pod spec.

intermediate

Why is it important to use Service Accounts instead of user credentials inside pods?

Using Service Accounts limits access to only what the pod needs, improving security by avoiding sharing user credentials and enabling fine-grained permissions.

What does a Kubernetes Service Account provide to a pod?

A A user login for the pod

B An API token to access the Kubernetes API

C A network IP address

D A storage volume

Service Accounts provide pods with API tokens to securely access the Kubernetes API.

Which field in a pod spec sets the Service Account to use?

A podAccount

B accountName

C userAccount

D serviceAccountName

The 'serviceAccountName' field specifies which Service Account the pod uses.

What is the name of the default Service Account in every Kubernetes namespace?

A system

B admin

C default

D kube-service

The default Service Account is named 'default' in every namespace.

Why should you avoid using user credentials inside pods?

A They can give too much access and are less secure

B They are slower to authenticate

C Pods cannot use user credentials

D User credentials expire too quickly

User credentials can give pods more access than needed and pose security risks.

How does Kubernetes provide the Service Account token to a pod?

A Mounted as a secret volume inside the pod

B Sent via environment variables

C Printed in pod logs

D Manually copied by the user

Kubernetes mounts the Service Account token as a secret volume inside the pod automatically.

Explain what a Kubernetes Service Account is and why it is used.

Think about how pods talk to Kubernetes safely.

Describe how to assign a specific Service Account to a pod and why you might want to do this.

Consider controlling what a pod can do.