RBAC and Service Accounts

RBAC has four objects: Role and ClusterRole list permissions; RoleBinding and ClusterRoleBinding grant them to users, groups or service accounts.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: { name: pod-reader, namespace: dev }
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: { name: read-pods, namespace: dev }
subjects:
  - kind: ServiceAccount
    name: ci
    namespace: dev
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

kubectl auth can-i list pods -n dev --as system:serviceaccount:dev:ci
kubectl auth can-i --list -n dev

Avoid cluster-admin for applications. Each workload should use its own service account, and automountServiceAccountToken: false for pods that never call the API. Since 1.21, tokens are time-limited projected tokens by default.