<p>I'm struggling to understand what the purpose it serves? </p>

<p>For example in the following pod definition:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  serviceAccountName: build-robot
</code></pre>

<p>When does the service account "matter"? In what interactions is it involved in?</p>

<p><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/</a> explains how to set a non default one, but doesn't really mention what effect / interactions are changed - or why you would need to do this?</p>

<p>The only hint it really gives is this section:</p>

<blockquote>
  <p>Processes in containers inside pods can also contact the apiserver.
  When they do, they are authenticated as a particular Service Account
  (for example, default).</p>
</blockquote>

<p>Which makes no sense what so ever. How does a arbitrary process magically become "authenticated" when it sends an HTTP request to the kubernetes API server? </p>

<p>Are there security benefits? If so what are they?</p>

<p>Pod which need to interact with Kubernetes API Server needs a service account to authenticate to Kubernetes API Server.</p>

<p>To communicate with the API server, a Pod uses a ServiceAccount containing an authentication token. Roles (e.g: the right to list all the Pods within a given namespace), or ClusterRole (eg: the right to read all the Secrets within the entire cluster), can then be bound to this ServiceAccount. Respectively with a RoleBinding or a ClusterRoleBinding, so the ServiceAccount is authorized to perform those actions.</p>

<p>A lot of applications that run in the cluster (read: running in Pods), need to communicate with the API server. Among them are the processes running within the Control Plane (scheduler, controller manager, proxy, etc.), as well as all the applications that need to perform some form of administration for the cluster such as controllers which manages custom resources.</p>
