Lab Solution Service Accounts

In this lab we inspect ServiceAccounts, examine the tokens mounted into Pods, and configure a Deployment so its Pods run with the correct ServiceAccount. This ensures an application (like a web dashboard) can authenticate to the Kubernetes API with the intended RBAC permissions.

1) How many ServiceAccounts exist in the `default` namespace?

Run:

kubectl get serviceaccounts -n default

Example output:

NAME      SECRETS   AGE
default   1         10d
dev       1         2d

In this cluster there are two ServiceAccounts in the default namespace: default and dev.

2) What Secret token is used by the `default` ServiceAccount?

Describe the default ServiceAccount:

kubectl describe sa default -n default

Look for the Tokens section. In this environment the default ServiceAccount shows:

Tokens: None

So the default ServiceAccount currently has no token listed (or none is shown).

3) Inspect the dashboard Deployment — what image does it use?

List Deployments and describe the web-dashboard Deployment:

kubectl get deployments -n default
kubectl describe deployment web-dashboard -n default

From the Deployment’s Pod template under Containers, the image is:

Image: gcr.io/kodekloud/customimage/my-kubernetes-dashboard

This is the container image used by the web-dashboard deployment.

4) When accessing the dashboard UI, an error appears: what does it mean?

When trying to list Pods from the dashboard UI, you may see an error like:

pods is forbidden: User "system:serviceaccount:default:default" cannot list resource "pods" in API group "" in the namespace "default"

This means the application is authenticating to the API as the default ServiceAccount (system:serviceaccount:default:default) and that ServiceAccount does not have RBAC permission to list Pods in the default namespace. In short: the dashboard is running under a ServiceAccount with insufficient privileges.

5) Which ServiceAccount is mounted to the dashboard Pod, and where are its credentials located?

Get the Pod name and describe it:

kubectl get pods -n default
kubectl describe pod <web-dashboard-pod-name> -n default

In the Pod description, check the Service Account field and the Mounts section. Example relevant parts:

Service Account:  default

Mounts:
  /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-swjvh (ro)

So:

The Pod is using the default ServiceAccount.
The ServiceAccount credentials (token, CA certificate, and namespace file) are projected into the Pod at /var/run/secrets/kubernetes.io/serviceaccount.

Also in the Volumes section you will often see the projected token details such as:

Volumes:
  kube-api-access-swjvh:
    Type: Projected
    TokenExpirationSeconds: 3607
    ConfigMapName: kube-root-ca.crt
    DownwardAPI: true

This shows Kubernetes automatically projects the token and related metadata into the Pod.

6) Create a new ServiceAccount for the dashboard: `dashboard-sa`

Create the ServiceAccount:

kubectl create serviceaccount dashboard-sa -n default

Expected output:

serviceaccount/dashboard-sa created

If the environment includes RBAC manifests, you may find role and rolebinding YAML files in a directory like /var/rbac/:

cd /var/rbac
ls

Example:

dashboard-sa-role-binding.yaml  pod-reader-role.yaml

Create a token for the new ServiceAccount (useful for testing by pasting into the dashboard UI):

kubectl create token dashboard-sa -n default

Example output (token truncated for brevity):

eyJhbGciOiJSUzI1NiIsImtpZCI6InU5U0pK...<snip>...LxkCzj4g

Service account tokens are sensitive credentials. Do not share them, and never commit them into source control.

After pasting this token into the dashboard UI and reloading, the dashboard should be able to list Pods—provided the dashboard-sa has the correct RBAC Role or RoleBinding applied in the environment.

Grant only the minimum permissions required to ServiceAccounts. Avoid binding overly broad roles such as cluster-admin unless absolutely necessary.

7) Configure the `web-dashboard` Deployment to use `dashboard-sa` automatically

Instead of manually pasting a token into the UI, update the Deployment so Pods automatically receive the dashboard-sa token. Add serviceAccountName: dashboard-sa under spec.template.spec in the Deployment manifest.

Export the existing Deployment to YAML:

kubectl get deployment web-dashboard -n default -o yaml > dashboard.yaml

Edit dashboard.yaml. Under spec.template.spec add the serviceAccountName field. Example snippet showing where to add it:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-dashboard
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      name: web-dashboard
  template:
    metadata:
      labels:
        name: web-dashboard
    spec:
      serviceAccountName: dashboard-sa
      containers:
      - name: web-dashboard
        image: gcr.io/kodekloud/customimage/my-kubernetes-dashboard
        env:
        - name: PYTHONUNBUFFERED
          value: "1"

Apply the updated Deployment:

kubectl apply -f dashboard.yaml -n default

You may see a warning if the Deployment was originally created by a different method, but the update will still be applied. Verify the Deployment status:

kubectl get deployment web-dashboard -n default

Example:

NAME            READY   UP-TO-DATE   AVAILABLE   AGE
web-dashboard   1/1     1            1           2m

When the new Pod is running, refresh the dashboard UI. Because the Pod now mounts the dashboard-sa token automatically at /var/run/secrets/kubernetes.io/serviceaccount, the dashboard will authenticate as system:serviceaccount:default:dashboard-sa and should be able to list Pods if RBAC permits.

Quick reference — common commands

Task	Command / Example
List ServiceAccounts in `default`	`kubectl get serviceaccounts -n default`
Describe a ServiceAccount	`kubectl describe sa default -n default`
Get Deployments in `default`	`kubectl get deployments -n default`
Describe the dashboard Deployment	`kubectl describe deployment web-dashboard -n default`
Describe a Pod	`kubectl describe pod <web-dashboard-pod-name> -n default`
Create ServiceAccount	`kubectl create serviceaccount dashboard-sa -n default`
Create token for SA	`kubectl create token dashboard-sa -n default`
Export Deployment to YAML	`kubectl get deployment web-dashboard -n default -o yaml > dashboard.yaml`
Apply updated Deployment	`kubectl apply -f dashboard.yaml -n default`

Summary

The dashboard was running with the default ServiceAccount, which lacked permission to list Pods.
You created dashboard-sa, generated a token to test permissions, and then updated the Deployment to use serviceAccountName: dashboard-sa. Future Pods will automatically mount the correct token and use the intended RBAC identity.

Links and references

Introduction

Core Concepts

Scheduling

Logging & Monitoring

Application Lifecycle Management

Cluster Maintenance

Security

Storage

Networking

Design and Install a Kubernetes Cluster

Install "Kubernetes the kubeadm way"

Troubleshooting

Helm Basics (2025 Updates)

Kustomize Basics (2025 Updates)

Other Topics

Mock Exams

Lab Solution Service Accounts

1) How many ServiceAccounts exist in the `default` namespace?

2) What Secret token is used by the `default` ServiceAccount?

3) Inspect the dashboard Deployment — what image does it use?

4) When accessing the dashboard UI, an error appears: what does it mean?

5) Which ServiceAccount is mounted to the dashboard Pod, and where are its credentials located?

6) Create a new ServiceAccount for the dashboard: `dashboard-sa`

7) Configure the `web-dashboard` Deployment to use `dashboard-sa` automatically

Quick reference — common commands

Watch Video

​1) How many ServiceAccounts exist in the default namespace?

​2) What Secret token is used by the default ServiceAccount?

​3) Inspect the dashboard Deployment — what image does it use?

​4) When accessing the dashboard UI, an error appears: what does it mean?

​5) Which ServiceAccount is mounted to the dashboard Pod, and where are its credentials located?

​6) Create a new ServiceAccount for the dashboard: dashboard-sa

​7) Configure the web-dashboard Deployment to use dashboard-sa automatically

​Quick reference — common commands

Watch Video

1) How many ServiceAccounts exist in the `default` namespace?

2) What Secret token is used by the `default` ServiceAccount?

3) Inspect the dashboard Deployment — what image does it use?

4) When accessing the dashboard UI, an error appears: what does it mean?

5) Which ServiceAccount is mounted to the dashboard Pod, and where are its credentials located?

6) Create a new ServiceAccount for the dashboard: `dashboard-sa`

7) Configure the `web-dashboard` Deployment to use `dashboard-sa` automatically

Quick reference — common commands