When a Pod is created in Kubernetes without specifying a Service Account, which default Service Account is used?

When a Pod is created in Kubernetes without specifying a Service Account, which default Service Account is used?

• A. serviceaccount
• B. default
• C. root
• D. pod-sa

Answer: (B)

When a Pod starts without a specified ServiceAccount, Kubernetes uses the namespace’s default service account. Every namespace has a default ServiceAccount named default that is created automatically. The Pod runs with that identity, and a token for that ServiceAccount is mounted into the Pod so it can access the Kubernetes API according to the permissions bound to that SA. If you want the Pod to use a different identity, you would set serviceAccountName in the Pod spec to the name of another pre-created ServiceAccount. The other names listed would only apply if such ServiceAccounts exist and are explicitly referenced.

When a Pod starts without a specified ServiceAccount, Kubernetes uses the namespace’s default service account. Every namespace has a default ServiceAccount named default that is created automatically. The Pod runs with that identity, and a token for that ServiceAccount is mounted into the Pod so it can access the Kubernetes API according to the permissions bound to that SA. If you want the Pod to use a different identity, you would set serviceAccountName in the Pod spec to the name of another pre-created ServiceAccount. The other names listed would only apply if such ServiceAccounts exist and are explicitly referenced.