A Deployment’s Pod template sets serviceAccountName: permits-api. C…

Question

A Deployment’s Pod template sets serviceAccountName: permits-api. Controllers create and manage those Pods, but live API calls from inside a running Pod use that ServiceAccount’s token. When debugging Forbidden errors from the application process, which identity matters most?

Accepted Answer

The permits-api ServiceAccount mounted into the Pod, not the human kubectl user who applied the Deployment — Whoever clicked apply is not who the app is when it talks to the API. The Pod wears the ServiceAccount badge in its template. Check that SA’s RoleBindings when the process itself gets Forbidden.

Answer

Only the cluster-admin user listed in the kubeconfig used to create the Deployment

Answer

The default ServiceAccount in kube-system, because all app Pods inherit it

Answer

The Node’s kubelet client certificate, which proxies every in-Pod HTTPS call

A Deployment’s Pod template sets serviceAccountName: permits-api. Controllers create and manage those Pods, but live API calls from inside a running Pod use that ServiceAccount’s token. When debugging Forbidden errors from the application process, which identity matters most?

Short Explanation

Full Explanation