Public-works IoT operators ask whether a Pod’s ServiceAccount automatically inherits the Role of the human who applied the manifest. What is correct?
Select an answer to reveal the explanation.
Short Explanation
Who submitted the paperwork is not who the desk clerk becomes. The Pod speaks as its ServiceAccount, so that account needs its own RoleBindings. The human’s kubectl rights do not drip into the container identity.
Full Explanation
Admission of a manifest uses the applying user’s credentials; runtime API calls from the Pod use the Pod’s ServiceAccount. Those identities are independent: granting a human permission to create Pods does not grant the Pod permission to list Secrets or watch Endpoints. Bind Roles to the ServiceAccount explicitly. There is no inheritRbACFromUser Pod field, and Deployments do not change this model.