How is a ServiceAccount's API token made available to applications inside a pod, and how can an application use it?

• A. Tokens are embedded in the container images.
• B. The token is mounted as a file in the pod’s filesystem under the service account; applications can use it to authenticate to the API from within the cluster.
• C. Tokens are retrieved via an external service on startup.
• D. API tokens are not used for in-cluster authentication.

Answer: (B)

Inside a pod, applications authenticate to the cluster’s API using a token that is provided by the Pod’s ServiceAccount. This token isn’t baked into the container image; instead, the cluster automatically mounts a secret for the ServiceAccount into the pod’s filesystem. The application can then read that token file and use it to authenticate requests to the API server from within the cluster.

In practice, the token appears as a file inside the pod, commonly at a path like /var/run/secrets/kubernetes.io/serviceaccount/token, with the CA certificate and namespace also exposed in the same mounted secret. The application can pass the token as a Bearer token in HTTP requests when talking to the API, or rely on client libraries that are configured to use in-cluster credentials and automatically read this token from the standard path.

This approach avoids embedding credentials in container images and enables secure, automated authentication for in-cluster components.