<p>I'm using Kubeless on AWS EKS. While installing Kubeless, the installation has a <a href="https://github.com/kubeless/kubeless/releases/download/v1.0.6/kubeless-v1.0.6.yaml" rel="noreferrer">manifest</a> which has some CRDs and a deployment object. The deployment object has already a Service Account attached. I have created another <a href="https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/" rel="noreferrer">Service Account</a> <strong>in the <code>kube-system</code> namespace</strong>, which has some AWS IAM roles attached. I also want to attach this newly created Service Account used for IAM roles to the Kubeless deployment object by modifying the Kubeless manifest file.</p>

<p>I want to have 2 Service Accounts attached to the deployment object: One that comes with Kubeless and other for AWS IAM. Any help would appreciated. Thanks</p>

<p>This is not possible. If you look at the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#pod-v1-core" rel="noreferrer">API documentation</a> for <code>PodSpec v1 core</code> you can see that serviceAccountName expects a <code>string</code> not an <code>array</code> or <code>object</code>. This is because using a ServiceAccount resource creates a 1:1 relationship between your pod and <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="noreferrer">authentication</a> against the API server.</p>

<p>You will either need to:</p>

<ol>
<li><p>Diversify your workload into multiple containers. Which with you can apply different service accounts.</p></li>
<li><p>Combine your service account capabilities into a single account and apply it exclusively to this pod. </p></li>
</ol>

<p>I recommend #2. </p>
