How to create service account in Kubernetes

Introduction

In the complex world of Kubernetes, service accounts play a crucial role in managing authentication and authorization for applications and processes within a cluster. This tutorial will guide you through the essential steps of creating service accounts, understanding their significance, and implementing proper role-based access control in Kubernetes environments.

Skills Graph

Service Account Basics

What is a Service Account?

A Service Account in Kubernetes is a special type of account designed to provide identity and access management for processes running within pods. Unlike user accounts, service accounts are meant for programmatic interactions with the Kubernetes API and other system resources.

Key Characteristics of Service Accounts

Service Account Workflow

Use Cases

Service accounts are crucial in several scenarios:

• Authenticating applications running inside Kubernetes clusters
• Providing fine-grained access control
• Enabling automated interactions with Kubernetes API
• Securing microservices communication

Default Service Account

Every namespace in Kubernetes automatically creates a default service account. However, this default account has minimal permissions and should be carefully configured for specific use cases.

Best Practices

1. Create dedicated service accounts for different applications
2. Limit service account permissions using Role-Based Access Control (RBAC)
3. Rotate service account tokens periodically
4. Avoid using default service account for critical workloads

Example: Checking Default Service Account

## List service accounts in default namespace
kubectl get serviceaccounts

## Describe default service account
kubectl describe serviceaccount default

By understanding service accounts, developers using LabEx Kubernetes environments can implement more secure and controlled access mechanisms for their containerized applications.

Creating Service Accounts

Methods of Creating Service Accounts

Kubernetes provides multiple ways to create service accounts:

1. Using kubectl Command

## Create a service account in the default namespace
kubectl create serviceaccount my-service-account

## Create a service account in a specific namespace
kubectl create serviceaccount app-service-account -n development

2. Using YAML Configuration

apiVersion: v1
kind: ServiceAccount
metadata:
  name: custom-service-account
  namespace: default

Service Account Creation Workflow

Verification Methods

Advanced Configuration Options

Automounting Token

apiVersion: v1
kind: ServiceAccount
metadata:
  name: no-auto-mount
automountServiceAccountToken: false

Practical Example

## Create service account
kubectl create serviceaccount web-app-account

## Verify creation
kubectl get serviceaccount web-app-account

## Describe service account details
kubectl describe serviceaccount web-app-account

Best Practices for LabEx Kubernetes Environments

1. Use descriptive names for service accounts
2. Limit service account permissions
3. Avoid using default service account
4. Rotate service account tokens regularly

Token Retrieval

## Get service account token
TOKEN=$(kubectl get secret $(kubectl get serviceaccount web-app-account -o jsonpath='{.secrets[0].name}') -o jsonpath='{.data.token}' | base64 --decode)

By mastering service account creation in Kubernetes, developers can implement robust and secure access management for their containerized applications.

Role and Binding

Understanding RBAC in Kubernetes

Role Types

Role Definition Example

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

Binding Types

RoleBinding Example

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: ServiceAccount
  name: my-service-account
  namespace: default
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Permission Verbs

Practical Implementation

## Create service account
kubectl create serviceaccount app-service-account

## Create role
kubectl create role app-reader --verb=get --verb=list --resource=pods

## Bind role to service account
kubectl create rolebinding app-reader-binding \
  --role=app-reader \
  --serviceaccount=default:app-service-account

ClusterRole and ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

Best Practices for LabEx Kubernetes Environments

1. Apply least privilege principle
2. Use specific roles instead of broad permissions
3. Regularly audit and review role bindings
4. Separate concerns with distinct roles

Verification Commands

## List roles
kubectl get roles

## Describe role bindings
kubectl describe rolebindings

## Check service account permissions
kubectl auth can-i list pods --as=system:serviceaccount:default:app-service-account

By understanding roles and bindings, developers can implement fine-grained access control in Kubernetes, ensuring secure and controlled resource management.

Summary

By mastering service account creation and configuration in Kubernetes, you can establish robust security mechanisms that enable precise control over resource access. Understanding service accounts, roles, and bindings empowers you to implement fine-grained authentication strategies that protect your cluster's resources and ensure secure, controlled interactions between different components.