CKAD field manual

k8s ServiceAccount YAML example

Create the ServiceAccount, then point the Pod at it. Default is the default SA in that namespace.

Create

kubectl create sa runner -n app
kubectl get sa,secret -n app

ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: runner
  namespace: app

On a Pod

spec:
  serviceAccountName: runner
  automountServiceAccountToken: true
  containers:
    - name: app
      image: nginx:1.27

Fields

serviceAccountName: On spec. Not a label. Not serviceAccount.
automountServiceAccountToken: false if the Pod must not get a token.
kubectl create sa: Does not grant RBAC. Must exist in the same namespace as the Pod.

Field is serviceAccountName, on spec — not a label, not serviceAccount.
The SA must exist in the same namespace as the Pod. Creating the SA does not grant RBAC.
automountServiceAccountToken: false if the question says the Pod must not get a token.