{"slug": "create-a-kubernetes-service-account-and-assign-permissions", "title": "Create a Kubernetes service account and assign permissions", "summary": "A developer explains how to create a Kubernetes ServiceAccount and assign permissions using RBAC to follow the principle of least privilege. The guide covers creating a ServiceAccount, defining a Role for read-only access, and binding it via a RoleBinding. Properly configured ServiceAccounts are essential for security in production Kubernetes environments.", "body_md": "When deploying applications to Kubernetes, it's important to ensure they have only the permissions they actually need. This is where **ServiceAccounts** and **RBAC (Role-Based Access Control)** come into play.\n\nIn our case, the **ServiceAccount is required for the Agentic CLI to authenticate with the AKS cluster when running in cluster mode.**\n\nA **ServiceAccount** is an identity used by applications running inside a Kubernetes cluster. Unlike user accounts, which are intended for administrators and developers, ServiceAccounts allow pods to securely authenticate with the Kubernetes API.\n\nApplications commonly use a ServiceAccount to:\n\nRather than granting broad cluster-wide permissions, Kubernetes lets you assign only the permissions an application requires, following the **Principle of Least Privilege**.\n\nEvery Kubernetes namespace includes a default ServiceAccount.\n\n```\nkubectl get sa\n```\n\nExample output:\n\n```\nNAME      SECRETS   AGE\ndefault   0         10d\n```\n\nIf no ServiceAccount is specified in a Pod or Deployment, Kubernetes automatically uses the `default`\n\nServiceAccount.\n\nCreate a file named `serviceaccount.yaml`\n\n:\n\n```\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: my-app-sa\n  namespace: alpha\n```\n\nApply it:\n\n```\nkubectl apply -f serviceaccount.yaml\n```\n\nVerify it exists:\n\n```\nkubectl get sa -n alpha\n```\n\nReference the ServiceAccount using the `serviceAccountName`\n\nfield.\n\n```\napiVersion: v1\nkind: Pod\nmetadata:\n  name: nginx\nspec:\n  serviceAccountName: my-app-sa\n  containers:\n    - name: nginx\n      image: nginx\n```\n\nAny pod using this ServiceAccount will authenticate to the Kubernetes API as `my-app-sa`\n\n.\n\nCreating a ServiceAccount **does not automatically grant access** to Kubernetes resources.\n\nPermissions are assigned using **RBAC**:\n\nThe following Role allows read-only access to Pods, Services, and Endpoints.\n\n```\nkind: Role\napiVersion: rbac.authorization.k8s.io/v1\n\nmetadata:\n  namespace: dev\n  name: endpoints-reader\n\nrules:\n- apiGroups: [\"\"]\n  resources:\n    - pods\n    - services\n    - endpoints\n  verbs:\n    - get\n    - list\n    - watch\n```\n\nNext, bind the Role to the ServiceAccount.\n\n```\nkind: RoleBinding\napiVersion: rbac.authorization.k8s.io/v1\n\nmetadata:\n  name: read-access\n  namespace: dev\n\nsubjects:\n- kind: ServiceAccount\n  name: my-app-sa\n  namespace: dev\n\nroleRef:\n  kind: Role\n  name: endpoints-reader\n  apiGroup: rbac.authorization.k8s.io\n```\n\nAfter applying the Role and RoleBinding, the ServiceAccount can:\n\nNothing more.\n\nDescribe the Role to verify its permissions.\n\n```\nkubectl describe role endpoints-reader -n test-magik\n```\n\nExample output:\n\n```\nName:         endpoints-reader\nPolicyRule:\n  Resources   Verbs\n  ---------   ----------------\n  endpoints   get, list, watch\n  pods        get, list, watch\n  services    get, list, watch\n```\n\nYou can also verify what a ServiceAccount is allowed to do:\n\n```\nkubectl auth can-i list pods \\\n  --as=system:serviceaccount:dev:my-app-sa \\\n  -n dev\n```\n\nIf configured correctly, Kubernetes will return:\n\n```\nyes\n```\n\nGiving every application cluster-admin privileges is a significant security risk.\n\nUsing **ServiceAccounts** together with **RBAC** enables you to:\n\nProperly configured ServiceAccounts are a foundational security practice for any production Kubernetes environment.", "url": "https://wpnews.pro/news/create-a-kubernetes-service-account-and-assign-permissions", "canonical_source": "https://dev.to/prokshita_nagarajan_16a4d/create-a-kubernetes-service-account-and-assign-permissions-69p", "published_at": "2026-07-13 07:26:50+00:00", "updated_at": "2026-07-13 07:44:13.768933+00:00", "lang": "en", "topics": ["developer-tools"], "entities": ["Kubernetes", "AKS", "Agentic CLI"], "alternates": {"html": "https://wpnews.pro/news/create-a-kubernetes-service-account-and-assign-permissions", "markdown": "https://wpnews.pro/news/create-a-kubernetes-service-account-and-assign-permissions.md", "text": "https://wpnews.pro/news/create-a-kubernetes-service-account-and-assign-permissions.txt", "jsonld": "https://wpnews.pro/news/create-a-kubernetes-service-account-and-assign-permissions.jsonld"}}