Default Service Account

kubectl create namespace serviceaccount

kubectl run nginx-default-sa --image=nginx -n serviceaccount

kubectl get pods -n serviceaccount

• SA Token 은 기본값으로 "/var/run/secrets/kubernetes.io/serviceaccount/token" 경로에 저장

kubectl exec -it nginx-default-sa -n serviceaccount -- cat /var/run/secrets/kubernetes.io/serviceaccount/token

kubectl exec -it nginx-default-sa -n serviceaccount -- /bin/bash

APISERVER=https://kubernetes.default.svc
NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
CACERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api

• Default Service Account Token 에는 Pod 정보를 호출할 수 있는 권한이 없는 것을 확인

curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api/v1/namespaces/serviceaccount/pods

New Service Account