Library consortium apps currently share one ServiceAccount; ops wants each app to carry its own identity for RBAC. What should they do?
Select an answer to reveal the explanation.
Short Explanation
Shared badges blur who did what—give each library app its own ServiceAccount and point the Pod at it. That identity is what RBAC binds to, not the person who ran kubectl. Separate accounts make least-privilege bindings actually stick.
Full Explanation
Pods authenticate to the API as their ServiceAccount, selected with spec.serviceAccountName (otherwise default). Distinct ServiceAccounts per application let RoleBindings grant only the verbs each app needs. Human kubeconfig users do not become Pod identities, and widening a shared account undoes least privilege. Node SSH is unrelated to in-cluster API authorization.