A static content Pod never calls the Kubernetes API. Which setting…

Question

A static content Pod never calls the Kubernetes API. Which setting reduces unnecessary credential exposure?

Accepted Answer

Set automountServiceAccountToken: false on the Pod or its ServiceAccount so a token is not auto-mounted. — If the app never talks to the API, don't hang a VIP badge on it. Turn off automountServiceAccountToken so no token volume shows up by default. That shrinks the blast radius if the container is compromised.

Answer

Bind cluster-admin to the Pod so it can delete its own token after start.

Answer

Store the SA token in a ConfigMap and mount it world-readable for easier revocation.

Answer

Switch the Pod to hostNetwork so ServiceAccount tokens are unused by kubelet.

A static content Pod never calls the Kubernetes API. Which setting reduces unnecessary credential exposure?

Short Explanation

Full Explanation