<p>When a ServiceAccount created in Kubernetes a secret will be created too. This secret contains ServiceAccountToken. This token can be used in CI pipelines, even in kubectl and any where else to access the cluster.
Assume a developer in company copy this token for himself (and no ones know that) and after he left the company he still have access to our Kubernetes cluster. I want to limit his access. How can I do that?</p>

<p>Using a service account to interact with a kubernetes cluster from outside the cluster using kubectl or CI/CD systems is not the best approach from security point of view. You should rather use a <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authenticating-proxy" rel="nofollow noreferrer">authenticating proxy</a> wherein generation and rotation of short lived JWT token is delegated to an external OpenId/oAuth complaint authorization system.</p>
<p>Service accounts should only be used from a pod running inside the cluster and you can limit the authorization of the service account by <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">RBAC</a> Role and RoleBinding. Keep in mind that currently service account tokens are not rotated by kubernetes.</p>
