<p>How are service accounts supposed to be used? Should we create one service account per container? Is there any concept equivalent to "user group" in order to group service accounts?</p>

<p>Service Accounts are used by Pods to get access to Kubernetes API or Secrets. When a Pod is created, it gets a Service Account. The <code>default</code> Service Account for the same namespace is assigned to a Pod automatically. It can be specified in a description for Pod. Here you can find some examples: <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer">Configure Service Accounts for Pods</a></p>

<blockquote>
  <p>How are service accounts supposed to be used?</p>
</blockquote>

<p>If you want to configure permissions different from the default, you need to use Service Accounts. </p>

<blockquote>
  <p>Should we create one service account per container?</p>
</blockquote>

<p>In Kubernetes, a Pod is a set of one or more containers.<br>
You can create one Service Account and assign it to the first set of Pods. After that, create another Service Account with different permissions and assign it to the second set of Pods.</p>

<blockquote>
  <p>Is there any concept equivalent to "user group" in order to group service accounts?</p>
</blockquote>

<p>There is no such equivalent. But in terms of "user", "group", "role", we can say that Service Account is like a "role" for a Pod. </p>

<p>For more information, you can look through these links:</p>

<ul>
<li><a href="http://jeffmendoza.github.io/kubernetes/v1.0/docs/user-guide/service-accounts.html" rel="nofollow noreferrer">Service Accounts</a></li>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/" rel="nofollow noreferrer">Managing Service Accounts</a></li>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">Authenticating</a>, provided by @KonstantinVustin in comments</li>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/#a-quick-note-on-service-accounts" rel="nofollow noreferrer">Authorization Overview</a></li>
</ul>
