<p>I am setting up a namespace for my application that has statefulsets, deployments, and secrets into that namespace. Using RBAC, I am defining specific roles and binding them to a service account that is used by the deployment/statefulset. This works as expected. </p>

<p>Now when I try to test if the secrets are secure by not assigning any service account to the deployment, it still pulls down the secrets. The default service account in the namespace is bound with the view clusterrole which should not have access to secrets. </p>

<p>Any clue what is happening here? </p>

<p>Thanks in advance.   </p>

<p>I believe you need to assign a <code>RoleBinding</code> to the default service account on your namespace. For example:</p>

<pre><code>kubectl create rolebinding myapp-view-binding --clusterrole=view --serviceaccount=default:default --namespace=default
</code></pre>

<p>The view role should prevent you from reading secrets.</p>
