<p>Let's say I set up a fresh Kubernetes cluster. I assume the both <code>kube-system</code> and <code>default</code> namespaces will get a service account named <code>default</code>? Which permissions does that service account have? Full read/write permissions?</p>

<p>I'm essentially asking this to understand best practises to give a custom Go controller write access to resources.</p>

<p>Service accounts have no inherent permissions. The permissions they have depend entirely on the authorization mode configured (<code>--authorization-mode</code> flag passed to the apiserver)</p>

<p>Defining RBAC roles is a good method for specifying the permissions required for a controller.</p>

<p>There are existing role definitions for in-tree controllers at <a href="https://github.com/kubernetes/kubernetes/tree/master/plugin/pkg/auth/authorizer/rbac/bootstrappolicy" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/tree/master/plugin/pkg/auth/authorizer/rbac/bootstrappolicy</a></p>
