How to configure a non-default serviceAccount on a deployment

Question

My Understanding of this doc page is, that I can configure service accounts with Pods and hopefully also deployments, so I can access the k8s API in Kubernetes 1.6+. In order not to alter or use the default one I want to create service account and mount certificate into the pods of a deployment.

How do I achieve something similar like in this example for a deployment?

apiVersion: v1
kind: Pod
metadata:
   name: my-pod
spec:
  serviceAccountName: build-robot
  automountServiceAccountToken: false

Meir

I think you need to put a little more detail in the question – Nisan

@JanosLenart will do in an hour or two due to transit. Thx – Meir

Answer 1

As you will need to specify 'podSpec' in Deployment as well, you should be able to configure the service account in the same way. Something like:

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: my-deployment
spec:
  template:
    # Below is the podSpec.
    metadata:
      name: ...
    spec:
      serviceAccountName: build-robot
      automountServiceAccountToken: false
      ...

Sieracki

how can i pass namespace with the serviceaccountName? – Herrera

Is it able to specify the certain serviceAccountName under a name-space? so that, I don't need to change the Pod, Deployment yaml files. – Idden

searching for this answer too: how to specify the namespace of a service account? GKE – Loreanloredana

to specify a service account under a namespace, use the -n tag. or do it in the service account file. for example: apiVersion: v1 kind: ServiceAccount metadata: name: ServiceAccountName namespace: ServiceAccountNamespace and you can create the file with kubectl apply -f filename.yaml or kubectl apply -f filename -n ServiceAccountNamespace if not specified inside the file – Aleman

What is the use of providing such serviceaccount inside a deployment file and not providing at all and providing a custom service account within the ns for rbac ? – Alignment

Did you then mount the token inside the pod as decribed here kubernetes.io/docs/tasks/access-application-cluster/…? For some reasons, I don´t get this answer to work. – Ardeth

Answer 2

kubernetes nginx-deployment.yaml where serviceAccountName: test-sa
used as non default service account

Link: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

test-sa.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
  namespace: test-ns

---

nginx-deployment.yaml

apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: nginx
      namespace: test-ns
    spec:
      strategy:
        type: Recreate
      selector:
        matchLabels:
          app: nginx
      replicas: 1 # tells deployment to run 1 pods matching the template
      template: # create pods using pod definition in this template
        metadata:
          labels:
            app: nginx
        spec:
          serviceAccountName: test-sa
          containers:
          - name: nginx
            image: nginx
            ports:
            - containerPort: 80

Fluctuation