Service accounts in Kubernetes - Step-by-Step Execution

Process Flow - Service accounts

Create ServiceAccount YAML

↓

kubectl apply -f serviceaccount.yaml

↓

Kubernetes API Server creates ServiceAccount object

↓

Pod spec references ServiceAccount

↓

Pod starts with ServiceAccount token mounted

↓

Pod uses token to authenticate to API Server

This flow shows how a Kubernetes ServiceAccount is created, applied, linked to a Pod, and used for API authentication.

Execution Sample

Kubernetes

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
---
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  serviceAccountName: my-service-account
  containers:
  - name: app
    image: busybox
    command: ["sleep", "3600"]

This YAML creates a ServiceAccount and a Pod that uses it to authenticate with the Kubernetes API.

Process Table

Step	Action	Resource Created/Updated	State Change	Result
1	Apply ServiceAccount YAML	ServiceAccount 'my-service-account'	ServiceAccount object created in cluster	ServiceAccount available for pods
2	Apply Pod YAML referencing ServiceAccount	Pod 'my-pod'	Pod spec includes serviceAccountName: my-service-account	Pod created (Pending)
3	Pod starts running	Pod 'my-pod' running	ServiceAccount token mounted in Pod filesystem	Pod can authenticate to API Server using token
4	Pod uses token to call API	API Server authentication	Token validated	Pod authorized as 'my-service-account'
5	Pod terminates or deleted	Pod removed	ServiceAccount remains	ServiceAccount reusable for other pods

💡 Pod lifecycle ends; ServiceAccount persists independently

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
ServiceAccount 'my-service-account'	Not present	Created	Exists	Exists	Exists	Exists
Pod 'my-pod'	Not present	Not present	Created (Pending)	Running with SA token	Running with SA token	Deleted
SA Token in Pod	None	None	None	Mounted	Used for API auth	Removed with Pod

Key Moments - 3 Insights

Why does the ServiceAccount still exist after the Pod is deleted?

Because ServiceAccounts are cluster resources independent of Pods. The execution_table row 5 shows the Pod is removed but the ServiceAccount remains for reuse.

How does the Pod get the ServiceAccount token?

The Pod spec references the ServiceAccount name (row 2), so Kubernetes mounts the token automatically inside the Pod when it starts (row 3).

Can a Pod authenticate to the API Server without a ServiceAccount?

By default, Pods use the default ServiceAccount in their namespace. Without specifying one, Kubernetes still mounts a token for authentication.

Visual Quiz - 3 Questions

Look at the execution_table, at which step is the ServiceAccount token mounted inside the Pod?

A Step 3

B Step 4

C Step 2

D Step 5

💡 Hint

Check the 'State Change' column for when the token is mounted (Step 3).

According to variable_tracker, what is the state of the Pod after Step 4?

A Not present

B Created but not running

C Running with SA token

D Deleted

💡 Hint

Look at the 'Pod my-pod' row under 'After Step 4' column.

If the Pod YAML did not specify serviceAccountName, what would happen?

A Pod would not start

B Pod would use the default ServiceAccount

C Pod would have no API access

D Pod would create a new ServiceAccount automatically

💡 Hint

Recall Kubernetes default behavior for Pods without explicit ServiceAccount (key_moments #3).

Concept Snapshot

ServiceAccount in Kubernetes:
- Defines identity for Pods to access API Server
- Created as a cluster resource (kubectl apply)
- Pod spec references ServiceAccount by name
- Kubernetes mounts token inside Pod automatically
- Token used for API authentication
- ServiceAccount persists beyond Pod lifecycle

Full Transcript

This visual execution trace shows how Kubernetes ServiceAccounts work. First, a ServiceAccount resource is created using YAML and applied to the cluster. Then, a Pod is created referencing this ServiceAccount by name. When the Pod starts, Kubernetes mounts the ServiceAccount token inside the Pod automatically. The Pod uses this token to authenticate to the Kubernetes API Server. Even after the Pod is deleted, the ServiceAccount remains available for other Pods. This separation allows secure and reusable identities for Pods to interact with the cluster.