Why should powerful Roles not be bound to the namespace default ServiceAccount?
Select an answer to reveal the explanation.
Short Explanation
Default SA is the shared hallway badge—lots of Pods wear it if you don't pick another. Hang powerful Roles on it and you've handed those rights to anyone still on default. Use dedicated ServiceAccounts for privileged apps instead.
Full Explanation
Pods that omit serviceAccountName use the namespace default ServiceAccount. Binding strong Roles to that SA unintentionally grants those permissions to many workloads. Dedicated ServiceAccounts with explicit bindings keep privileges scoped. Default SAs can be referenced and can use RoleBindings; they are not API-rejected or ClusterRole-only.