<p>When I create a service account in Kubernetes with the following specification</p>
<pre><code>---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: deploy-bot
</code></pre>
<p>It automatically creates the following secret with prefix <code>deploy-bot-token-XXXX</code></p>
<pre><code>$ kubectl get secret

NAME                                                      TYPE                                  DATA   AGE
default-token-lvq79                                       kubernetes.io/service-account-token   3      60m
deploy-bot-token-7gmnh                                    kubernetes.io/service-account-token   3      4m53s
</code></pre>
<p>Is there a way via which we can disable the automatic creation of secret tokens while creating service accounts?</p>

<p>You can achieve it by modifying <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/" rel="nofollow noreferrer"><code>kube-controller-manager</code> options</a>.</p>
<p>The flag to be passed to the controller is <code>--controllers=-serviceaccount-token</code>. It will disable creating token for service accounts.</p>
<pre><code>spec:
  containers:
  - command:
    - kube-controller-manager
    - --controllers=-serviceaccount-token
 [...]
</code></pre>
<p>After this modification when you deploy your service account:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: deploy-bot

$ kubectl get sa
NAME         SECRETS   AGE
default      1         14m
deploy-bot   0         3s
</code></pre>
<p>and check the secrets created, you will notice that the secret has not been created:</p>
<pre><code>$ kubectl get secret
NAME                  TYPE                                  DATA   AGE
default-token-t4qnv   kubernetes.io/service-account-token   3      14m
</code></pre>
