Kubernetes / Cluster Operations, Access & Incident Response
Confirm the service account a workload actually uses
A workload can unexpectedly run as the namespace's default account rather than its intended identity. Inspect the created Pod.
Environment and inputs: Kubernetes · kubectl with supported client/server versions and delegated RBAC. Examples use namespace app unless noted. Check context, namespace, APIs and provider support first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
kubectl -n app get pod web-0 -o jsonpath='{.spec.serviceAccountName}{" "}{.spec.automountServiceAccountToken}'Read the result
The account and mount setting describe this Pod's configuration. Effective permission depends on bindings and any explicit projected token sources.
Resolve and verify
Compare the identity with the approved application access model, then correct the managed template and narrow bindings. Validate the application's permitted API calls.
Before changing production
Do not attach a privileged account or mount a token when the application needs no Kubernetes API access.