Service Account 是面向 namespace 的，每個 namespace 創建的時候，kubernetes 會自動在這個 namespace 下面創建一個默認的 Service Account；並且這個 Service Account 只能訪問該 namespace 的資源。Service Account 和 pod、service、deployment 一樣是 kubernetes 集群中的一種資源，用戶也可以創建自己的 serviceaccount。

ServiceAccount 主要包含了三個內容：namespace、Token 和 CA。namespace 指定了 pod 所在的 namespace，CA 用於驗證 apiserver 的證書，token 用作身份驗證。它們都通過 mount 的方式保存在 pod 的文件系統中，其中 token 保存的路徑是 /var/run/secrets/kubernetes.io/serviceaccount/token ，是 apiserver 通過私鑰簽發 token 的 base64 編碼後的結果； CA 保存的路徑是 /var/run/secrets/kubernetes.io/serviceaccount/ca.crt ，namespace 保存的路徑是 /var/run/secrets/kubernetes.io/serviceaccount/namespace ，也是用 base64 編碼。

2.
通過例子深入了解

集群默認namespace的sa，見下

[root@k8s-master1 ~]# kubectl get sa
NAME? ? ? SECRETS?? AGE
default?? 1? ? ? ?? 21d
[root@k8s-master1 ~]#

查看下詳情

[root@k8s-master1 ~]# kubectl get sa -o yaml
apiVersion: v1
items:
- apiVersion: v1
? kind: ServiceAccount
? metadata:
? ? creationTimestamp: 2018-08-29T02:57:06Z
? ? name: default
? ? namespace: default
? ? resourceVersion: "230"
? ? selfLink: /api/v1/namespaces/default/serviceaccounts/default
? ? uid: 36f3cd9f-ab37-11e8-97db-000c29424904
? secrets:
? - name: default-token-5dbc7
kind: List
metadata:
? resourceVersion: ""
? selfLink: ""
[root@k8s-master1 ~]#
 

可以看到，sa用到了secret ??default-token-5dbc7

3.
檢查下secret

[root@k8s-master1 ~]# kubectl get secret
NAME? ? ? ? ? ? ? ? ? TYPE? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? DATA? ? ? AGE
default-token-5dbc7?? kubernetes.io/service-account-token?? 3? ? ? ?? 21d
[root@k8s-master1 ~]#

詳情
[root@k8s-master1 ~]# kubectl get secret ?default-token-5dbc7 -o yaml
apiVersion: v1
items:
- apiVersion: v1
? data:
? ? ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURzRENDQXBpZ0F3SUJBZ0lVTWRteDZ0WktZbmh6d1NweVJsa3d1bUlyMys0d0RRWUpLb1pJaHZjTkFRRUwKQlFBd1hqRUxNQWtHQTFVRUJoTUNRMDR4Q3pBSkJnTlZCQWdUQWxOYU1Rc3dDUVlEVlFRSEV3SlRXakVNTUFvRwpBMVVFQ2hNRGF6aHpNUkl3RUFZRFZRUUxFd2swVUdGeVlXUnBaMjB4RXpBUkJnTlZCQU1UQ210MVltVnlibVYwClpYTXdIaGNOTVRnd09ESTRNRFl6TXpBd1doY05Nak13T0RJM01EWXpNekF3V2pCZU1Rc3dDUVlEVlFRR0V3SkQKVGpFTE1Ba0dBMVVFQ0JNQ1Uxb3hDekFKQmdOVkJBY1RBbE5hTVF3d0NnWURWUVFLRXdOck9ITXhFakFRQmdOVgpCQXNUQ1RSUVlYSmhaR2xuYlRFVE1CRUdBMVVFQXhNS2EzVmlaWEp1WlhSbGN6Q0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKa2UxV05VSCthUUJvV1NLWXVmSmNHWnExWDNwWXZHaytJazBLS08Kb3FZK1BJRFRvdWxTU215RkViOXJRS0prZ2lWeDBzbEZUT3R6ZGswZm03RVVzQU84aE9uQzdyNmwrYWtBOVZmaQpNK0EveXY0SVpRb1BuVHViaWVFRDZZaVhjc0NUSGFNVWtxektkUCtzbGxoQ3EwNVFNYnl1MmJDSGI5MjRrMXZVCjhTMWFvMlFJdUVpSWlSK2U1ejNrRFBGeXBuSm52bnR6UWNWVmd2MkxHYVFpd1BKak4veW8rUHJTNmN2aVEzMmIKUFJsVDc3b2RUZmpETTRsRjltTGlZQ3Z6em1pczhBUFJXSm1rNXJLbjl1NUEwQ2pUUy9yc0Y0dXFwaUIvcDNFaQpuRm5tcjhuQW1OZVFyYmdDMWhqTGdPR0tnWUs3QzhMZExmUHFDN2tLSkx5L3VjRUNBd0VBQWFObU1HUXdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQklHQTFVZEV3RUIvd1FJTUFZQkFmOENBUUl3SFFZRFZSME9CQllFRkl4SGVqWFoKMGtkbDR1UDJETmhlQ2YrZEFtUjlNQjhHQTFVZEl3UVlNQmFBRkl4SGVqWFowa2RsNHVQMkROaGVDZitkQW1SOQpNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUFpU3lNUEx3TUJFYXFqOXRzZUlMZU9Zczh4UGZOSHBRREdjOEZLCmc1eTJPaUlXUlV4SXZVRVFhbEMzR1BLc1JBdWM5YlhPdG9KWXZqVEtjYzloQU1sQTdzNU9LZEVvNFR4emREVkcKYmdlTFhyaHJmbzZXZ3ZWL1Nab1pOejJwRUE5OFRhWlNiVjB4MVFIZmUzMEJjdXdKSWJNVW4vd0NEZE9QeVJQMApDN2kzMW9VQTA5Z2tKZ2lSTEthK1h5RU5BUXI1QXp4ZlhvVDZ0UllreFdLKzhUOWJZOEcxMGswbU5MQktIbmp3ClZaZzZzSmo3bHU3eTR4SDdOdTUycTdsSlV2STdtcjFEUFU5T2hzL2tJRTNYWlNJaDJmRU03eUNkVVhsMlVBMkIKWnc2Uit0dy9wL1FZZTM5VTVhSENZV1NnTWpjTHBHTXkrb1I0M3VRV0kxS2YyVGVUCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
? ? namespace: ZGVmYXVsdA==
? ? token: ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNklpSjkuZXlKcGMzTWlPaUpyZFdKbGNtNWxkR1Z6TDNObGNuWnBZMlZoWTJOdmRXNTBJaXdpYTNWaVpYSnVaWFJsY3k1cGJ5OXpaWEoyYVdObFlXTmpiM1Z1ZEM5dVlXMWxjM0JoWTJVaU9pSmtaV1poZFd4MElpd2lhM1ZpWlhKdVpYUmxjeTVwYnk5elpYSjJhV05sWVdOamIzVnVkQzl6WldOeVpYUXVibUZ0WlNJNkltUmxabUYxYkhRdGRHOXJaVzR0TldSaVl6Y2lMQ0pyZFdKbGNtNWxkR1Z6TG1sdkwzTmxjblpwWTJWaFkyTnZkVzUwTDNObGNuWnBZMlV0WVdOamIzVnVkQzV1WVcxbElqb2laR1ZtWVhWc2RDSXNJbXQxWW1WeWJtVjBaWE11YVc4dmMyVnlkbWxqWldGalkyOTFiblF2YzJWeWRtbGpaUzFoWTJOdmRXNTBMblZwWkNJNklqTTJaak5qWkRsbUxXRmlNemN0TVRGbE9DMDVOMlJpTFRBd01HTXlPVFF5TkRrd05DSXNJbk4xWWlJNkluTjVjM1JsYlRwelpYSjJhV05sWVdOamIzVnVkRHBrWldaaGRXeDBPbVJsWm1GMWJIUWlmUS5CSUM3TXZUeU5zRWt0ZUF1TzZqS3VpLXNVa1dudzJFU2NtQ05DbWlKRkZId0JnVF9LTW5yRE1kU044VE9kdV9pMDRDTFVpaFU0U1RkUXFqWG1XcndFX2JyUmJlVGdtY2pkdXgyUzVScUwyc1RpaUx5Q1l5dXkwR3l2d1NNRWxHWjVtbTVrd1ByUm02VVJJcUdZNm5JeWdlRmZzaDdZZUVPd3ZBbnl5dXVxMkNnQ3RiZjlTdFNUSnlNdUcyQTNWbWFMVmJlOFoya2lnUDE0NWduYXBPdnFrYzhJaDk0X0Q2YS1JWDZOWk5ZM0hxcWdEMGNCY0JyMFFLak1INWh4NkMwcGxRQ0MxdmhfaE1OeEk1TG1rMmppWHN5Q0NoM2FRd1BwblNjVEFGNmFUNWZzREtlVWNLeTJ1RDNQRWptWTJHRmJiUHMwZWRrTUF1anBTY3kwUVIzeFE=
? kind: Secret
? metadata:
? ? annotations:
? ? ? kubernetes.io/service-account.name: default
? ? ? kubernetes.io/service-account.uid: 36f3cd9f-ab37-11e8-97db-000c29424904
? ? creationTimestamp: 2018-08-29T02:57:06Z
? ? name: default-token-5dbc7
? ? namespace: default
? ? resourceVersion: "228"
? ? selfLink: /api/v1/namespaces/default/secrets/default-token-5dbc7
? ? uid: 36ff3abd-ab37-11e8-97db-000c29424904
? type: kubernetes.io/service-account-token
kind: List
metadata:
? resourceVersion: ""
? selfLink: ""
[root@k8s-master1 ~]#

參數說明:
? ca.crt ? 根證書 ? 集群環境是ssl環境 ? 必須通過根證書認證才能訪問集群api服務
??token ? token唯一標識請求者，只要apiserver存在該token，則認證通過

4.
sa在po裏的使用情況

[root@k8s-master1 ~]# kubectl get pod
NAME? ? ? ? ? ? ? ? ? ? ? ?? READY? ?? STATUS? ? RESTARTS?? AGE
httpd-app-6dc78c4869-dbpxc?? 1/1? ? ?? Running?? 17? ? ? ?? 19d
httpd-app-6dc78c4869-pbxqp?? 1/1? ? ?? Running?? 10? ? ? ?? 6d
httpd-app-6dc78c4869-rkxn2?? 1/1? ? ?? Running?? 8? ? ? ? ? 22h
httpd-app-6dc78c4869-wh57f?? 1/1? ? ?? Running?? 9? ? ? ? ? 7d
httpd-app-6dc78c4869-z9mc9?? 1/1? ? ?? Running?? 21? ? ? ?? 19d
nginx? ? ? ? ? ? ? ? ? ? ? ? 1/1? ? ?? Running?? 13? ? ? ?? 7d
[root@k8s-master1 ~]#

檢查下nginx 這個pod的sa情況

[root@k8s-master1 ~]# kubectl get pod nginx -o yaml
apiVersion: v1
kind: Pod
metadata:
? annotations:
? ? kubectl.kubernetes.io/last-applied-configuration: |
? ? ? {"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{},"name":"nginx","namespace":"default"},"spec":{"containers":[{"image":"nginx:1.7.9","name":"nginx","ports":[{"containerPort":80}]}]}}
? creationTimestamp: 2018-09-11T07:58:19Z
? name: nginx
? namespace: default
? resourceVersion: "431013"
? selfLink: /api/v1/namespaces/default/pods/nginx
? uid: 72931cbf-b598-11e8-bfe9-000c29424904
spec:
? containers:
? - image: nginx:1.7.9
? ? imagePullPolicy: IfNotPresent
? ? name: nginx
? ? ports:
? ? - containerPort: 80
? ? ? protocol: TCP
? ? resources: {}
? ? terminationMessagePath: /dev/termination-log
? ? terminationMessagePolicy: File
? ? volumeMounts:
? ? - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
? ? ? name: default-token-5dbc7
? ? ? readOnly: true
? dnsPolicy: ClusterFirst
? nodeName: k8s-master3
? restartPolicy: Always
? schedulerName: default-scheduler
? securityContext: {}
? serviceAccount: default
? serviceAccountName: default
? terminationGracePeriodSeconds: 30
? tolerations:
? - effect: NoExecute
? ? key: node.kubernetes.io/not-ready
? ? operator: Exists
? ? tolerationSeconds: 300
? - effect: NoExecute
? ? key: node.kubernetes.io/unreachable
? ? operator: Exists
? ? tolerationSeconds: 300
? volumes:
? - name: default-token-5dbc7
? ? secret:
? ? ? defaultMode: 420
? ? ? secretName: default-token-5dbc7
status:
? conditions:
? - lastProbeTime: null
? ? lastTransitionTime: 2018-09-11T07:58:34Z
? ? status: "True"
? ? type: Initialized
? - lastProbeTime: null
? ? lastTransitionTime: 2018-09-19T05:20:58Z
? ? status: "True"
? ? type: Ready
? - lastProbeTime: null
? ? lastTransitionTime: 2018-09-11T07:58:32Z
? ? status: "True"
? ? type: PodScheduled
? containerStatuses:
? - containerID: docker://aecc2757eb489742f50cf076f2b00c685d145d0b9ebaa029d62b65e8cce5e55d
? ? image: nginx:1.7.9
? ? imageID: docker-pullable://nginx@sha256:e3456c851a152494c3e4ff5fcc26f240206abac0c9d794affb40e0714846c451
? ? lastState:
? ? ? terminated:
? ? ? ? containerID: docker://69069b6ddc723f5928ee58305bb1e44586516fd246fe8071ed3ae1b023ad3e31
? ? ? ? exitCode: 255
? ? ? ? finishedAt: 2018-09-19T05:20:29Z
? ? ? ? reason: Error
? ? ? ? startedAt: 2018-09-19T03:50:30Z
? ? name: nginx
? ? ready: true
? ? restartCount: 13
? ? state:
? ? ? running:
? ? ? ? startedAt: 2018-09-19T05:20:58Z
? hostIP: 192.168.211.130
? phase: Running
? podIP: 172.30.1.4
? qosClass: BestEffort
? startTime: 2018-09-11T07:58:34Z
[root@k8s-master1 ~]#

具體點

? ? volumeMounts:
? ? - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
? ? ? name: default-token-5dbc7
? ? ? readOnly: true

?? serviceAccount: default
? ?serviceAccountName: default?

? ?? volumes:
? - name: default-token-5dbc7
? ? secret:
? ? ? defaultMode: 420
? ? ? secretName: default-token-5dbc7?

以上參數就是sa在pod裏的配置，指定了掛載路徑，sa名字，secrect名字
因為pod裏有了sa，有了secret token，pod通過這個sa token就可以訪問k8s集群api

k8s rbac serviceaccount基礎