What is a ServiceAccount, and how do pods use it?

• A. A ServiceAccount provides an identity for pods to access the API; pods automatically mount its token to authenticate with the cluster.
• B. A ServiceAccount is a network policy for pods; pods reference it to access network.
• C. A ServiceAccount stores container images; pods pull images from it.
• D. A ServiceAccount is a logging identity that exports logs to stackdriver.

Answer: (A)

A ServiceAccount is an identity for workloads to authenticate to the Kubernetes API server. When a pod runs, it is associated with a ServiceAccount (a default one if none is specified), and the cluster automatically provides a token for that account. That token is mounted into the pod (as a secret, typically exposed as a file) so the pod’s applications can call the API server using HTTP requests with a Bearer token. This identity lets the API server apply RBAC rules to determine what the pod is allowed to do, such as listing resources, watching for changes, or creating specific objects. The token can be rotated by the system, and the pod will continue to use the new token as long as the secret is updated. This is why ServiceAccounts are about identity and API access, not about network policies, storing container images, or exporting logs.