How do you customize the service account used by a deployment, and why would you do so?

• A. Service accounts are always default; you cannot customize.
• B. Specify spec.template.spec.serviceAccountName in the Deployment to use a specific service account; you would do so to grant the pods specific permissions via Roles or SCCs.
• C. Use metadata.annotations to assign service account.
• D. Create a separate Deployment for each service account.

Answer: (B)

Customizing which service account a deployment’s pods run as is about tying the pod’s permissions to a specific account. In a Deployment, the Pod template defines the actual pods, and you set the serviceAccountName field in that template (spec.template.spec.serviceAccountName) to the service account you want those pods to use. That binding makes the pods operate under that account’s identity, so they inherit the permissions granted to that service account via RBAC Roles/Bindings or OpenShift SCCs.

Why you’d do this: you want the pods to have only the permissions they need and nothing more. By choosing a dedicated service account, you can attach restricted Roles or SCCs specifically to that account, controlling what the pods can access (secrets, config maps, API actions, etc.) and enhancing security.

If you don’t set it, the pods use the namespace’s default service account, which might have broader or undesired permissions. Creating separate deployments for different service accounts is possible but unnecessary when you can simply configure the serviceAccountName in the pod template. Annotations in metadata aren’t used to assign a service account.