A municipal billing Deployment and its metrics sidecar should not s…

Question

A municipal billing Deployment and its metrics sidecar should not share one over-privileged identity. What ServiceAccount pattern best supports least privilege?

Accepted Answer

Create a dedicated ServiceAccount for each app component and bind only the RBAC each component needs. — One shared "everything" badge for every desk is how privilege creeps. Give each component its own ServiceAccount and only the Role bindings it needs. Default SA everywhere or cluster-admin tokens are the opposite of least privilege.

Answer

Use the default ServiceAccount in every namespace for all Pods to simplify operations.

Answer

Mount the same cluster-admin token Secret into every container as an environment variable.

Answer

Disable ServiceAccounts entirely and hard-code kubeconfig files with full admin credentials in the image.

A municipal billing Deployment and its metrics sidecar should not share one over-privileged identity. What ServiceAccount pattern best supports least privilege?

Short Explanation

Full Explanation