Service Accounts

Module

A service account provides an identity for processes that run in a Pod.

Overview

At the end of this module, you will :

  • Learn to create a service accounts

  • Learn how to manage access

  • Learn how to secure a Pods

Prerequisites

Create the directory data/sa in your home folder to manage the YAML file needed in this module.

mkdir ~/data/serviceaccount

Create

Kubernetes service accounts provide access control to the Kubernetes API for services running in pods.

Kubernetes enables access control for workloads by providing service accounts. A service account represents an identity for processes that run in a pod. When a process is authenticated through a service account, it can contact the API server and access cluster resources. If a pod doesn’t have an assigned service account, it gets the default service account.

The create command can create a Ingress object based on a yaml file definition.

Exercise n°1

Create a service account call myfirstserviceaccount.

kubectl create serviceaccount myfirstserviceaccount

Exercise n°2

Create a service account named mysecondserviceaccount with a yaml file definition.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: mysecondserviceaccount

Create a resource based on the previous yaml file definition.

kubectl apply  -f data/serviceaccount/01_sa.yaml

Get

The get command list the object asked. It could be a single object or a list of multiple objects comma separated. This command is useful to get the status of each object. The output can be formatted to only display some information based on some json search or external tools like tr, sort, uniq.

The default output display some useful information about each services :

  • Name : the name of the newly created resource

  • Secrets : the number of secrets associated

  • Age : the age since his creation

Exercise n°1

List the current service account resources created.

kubectl get serviceaccounts

Describe

Once an object is running, it is inevitably a need to debug problems or check the configuration deployed.

The describe command display a lot of configuration information about the Service Accounts (labels, annotations, etc.).

This command is really useful to introspect and debug an object deployed in a cluster.

Exercise n°1

Describe the service account myfirstserviceaccount previously created.

kubectl describe serviceaccount myfirstserviceaccount

Explain

Kubernetes come with a lot of documentation about his objects and the available options in each one. Those information can be fin easily in command line or in the official Kubernetes documentation.

The explain command allows to directly ask the API resource via the command line tools to display information about each Kubernetes objects and their architecture.

Exercise n°1

Get the documentation of a specific field of a service account resource.

kubectl explain serviceaccount

Delete

The delete command delete resources by filenames, stdin, resources and names, or by resources and label selector.

A service account can be deleted only if it is not used by a running Kubernetes resource.

Note that the delete command does NOT do resource version checks, so if someone submits an update to a resource right when you submit a delete, their update will be lost along with the rest of the resource.

Exercise n°1

Delete the previous service account created in command line.

kubectl delete serviceaccount myfirstserviceaccount

Module exercise

The purpose of this section is to manage each steps of the lifecycle of an application to better understand each concepts of the Kubernetes course.

The main objective in this module is to understand how to secure the internal access to respect the least privileges principles.

For more information about the application used all along the course, please refer to the Exercise App > Voting App link in the left panel.

Based on the principles explain in this module, try by your own to handle this steps. The development of a yaml file is recommended.

The file developed has to be stored in this directory : ~/data/votingapp/14_serviceaccounts

  1. Create a service account called vote

  2. Create a service account called result

  3. Configure the vote Pods to use the vote service accounts created

  4. Configure the vote Result to use the result service accounts created

External documentation

Those documentations can help you to go further in this topic :

Last updated