CODEWITHSUNDEEP
kubernetes
Ztyx
Ztyx

Reputation: 14959

What default permissions does default service account have?

Let's say I set up a fresh Kubernetes cluster. I assume the both kube-system and default namespaces will get a service account named default? Which permissions does that service account have? Full read/write permissions?

I'm essentially asking this to understand best practises to give a custom Go controller write access to resources.

Upvotes: 3

Views: 1605

Answers (1)

Jordan Liggitt
Jordan Liggitt

Reputation: 18161

Service accounts have no inherent permissions. The permissions they have depend entirely on the authorization mode configured (--authorization-mode flag passed to the apiserver)

Defining RBAC roles is a good method for specifying the permissions required for a controller.

There are existing role definitions for in-tree controllers at https://github.com/kubernetes/kubernetes/tree/master/plugin/pkg/auth/authorizer/rbac/bootstrappolicy

Upvotes: 4

Related Questions