Can a pod use more than one service account

Kubernetes
#1

Can a pod use more than one service account

#2

No; the serviceAccountName field is single valued.

#3

okay thanks.

what happens when a time-bound service account expires?
Is it renewed automatically or must it be renewed manually

#4

If I understand the docs correctly, the kublet corresponding to that pod will rotate the token before it expires.

1 Like
#5

That is indeed what happens. If you are using software in the pod that was built with a Kubernetes client library newer or equal to the version when this change was first introduced (1.22 I think), it will just work.

If you have software that uses the automounted token directly (by reading it from the mounted volume), then it should not cache this token as it will change when Kubernetes rotates it.

1 Like