<p>I'm trying to create a service account with either no secrets or just secret I specify and the kubelet always seems to be attaching the default secret no matter what.</p>

<h3>Service Account definition</h3>

<pre><code>apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
  name: test
secrets:
  - name: default-token-4pbsm
</code></pre>

<p><strong>Submit</strong></p>

<pre><code>$ kubectl create -f service-account.yaml
serviceaccount "test" created
</code></pre>

<p><strong>Get</strong></p>

<pre><code>$ kubectl get -o=yaml serviceaccount test
apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
  creationTimestamp: 2017-05-30T12:25:30Z
  name: test
  namespace: default
  resourceVersion: "31414"
  selfLink: /api/v1/namespaces/default/serviceaccounts/test
  uid: 122b0643-4533-11e7-81c6-42010a8a005b
secrets:
- name: default-token-4pbsm
- name: test-token-5g3wb
</code></pre>

<p>As you can see above the <code>test-token-5g3wb</code> was automatically created &amp; attached to the service account without me specifying it.</p>

<p>As far as I understand the <code>automountServiceAccountToken</code> only affects mounting of those secrets to a pod which was launched via that service account. (?)</p>

<p>Is there any way I can avoid that default secret being ever created and attached?</p>

<h3>Versions</h3>

<pre><code>$ kubectl version
Client Version: version.Info{Major:"1", Minor:"6", GitVersion:"v1.6.4", GitCommit:"d6f433224538d4f9ca2f7ae19b252e6fcb66a3ae", GitTreeState:"clean", BuildDate:"2017-05-19T20:41:24Z", GoVersion:"go1.8.1", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"6", GitVersion:"v1.6.4", GitCommit:"d6f433224538d4f9ca2f7ae19b252e6fcb66a3ae", GitTreeState:"clean", BuildDate:"2017-05-19T18:33:17Z", GoVersion:"go1.7.5", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<p>Your understanding of <code>automountServiceAccountToken</code> is right it is for pod that will be launched.</p>

<p>The automatic token addition is done by Token controller. Even if you edit the config to delete the token it will be added again.</p>

<blockquote>
  <p>You must pass a service account private key file to the token controller in the controller-manager by using the <strong><code>--service-account-private-key-file</code></strong> option. The private key will be used to sign generated service account tokens. Similarly, you must pass the corresponding public key to the kube-apiserver using the <strong><code>--service-account-key-file</code></strong> option. The public key will be used to verify the tokens during authentication.</p>
</blockquote>

<p>Above is taken from k8s <a href="https://kubernetes.io/docs/admin/service-accounts-admin/#token-controller" rel="nofollow noreferrer">docs</a>. So try not passing those flags, but not sure how to do that. But I not recommending doing that.</p>

<p>Also <a href="https://kubernetes.io/docs/admin/authentication/#service-account-tokens" rel="nofollow noreferrer">this doc</a> you might helpful.</p>
