A Pod must call cloud APIs using permissions bound to ServiceAccount geo-reader instead of the namespace default. What Pod field assigns that identity?
Select an answer to reveal the explanation.
Short Explanation
serviceAccountName is the badge clipped to the Pod—set it to geo-reader and the workload runs as that SA. Labels and imagePullSecrets don't swap the API identity by themselves. Default SA is what you get if you leave it blank.
Full Explanation
Pods authenticate to the API (and related projected tokens) using the ServiceAccount named in spec.serviceAccountName. Setting that field to a custom SA such as geo-reader replaces the default ServiceAccount for the Pod. generateName, imagePullSecrets, and labels alone do not assign the ServiceAccount identity.