<p>I have a container that I want to run on Kubernetes Let's say image1</p>

<p>when I run kubectl apply -f somePod.yml (which runs the image1) how can I start the image with the user that runned the command kubectl?  </p>

Jorge Machado
<p>It's not possible <a href="https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#user-accounts-vs-service-accounts" rel="nofollow noreferrer">by design</a>. Please find explanation below:</p>

<p>In the most cases Jobs create Pods, so I use Pods in my explanation.<br>
In case of Jobs it means just a bit different YAML file. </p>

<pre><code>$ kubectl explain job.spec.
$ kubectl explain job.spec.template.spec
</code></pre>

<p><strong>Users</strong> run <code>kubectl</code> using <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer"><strong>user accounts</strong>. </a></p>

<p><strong>Pods</strong> are runing using <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer"><strong>service accounts</strong></a>. There is no way to run pod <code>"from user account"</code>.<br>
<strong>Note:</strong> in recent versions <code>spec.ServiceAccount</code> was replaced by <code>spec.serviceAccountName</code></p>

<p><em>However</em>, you can use <strong>user account credentials</strong> by running <code>kubectl</code> inside a Pod's container or making <code>curl</code> requests to Kubernetes <code>api-server</code> from inside a pod container.<br>
Using <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Secrets</a> is the most convenient way to do that.</p>

<p>What else you can do differentiate users in the cluster: </p>

<ul>
<li>create a <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/" rel="nofollow noreferrer">namespace</a> for each user</li>
<li><a href="https://jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html" rel="nofollow noreferrer">limit user permission to specific namespace</a> </li>
<li>create default service account in that namespace. </li>
</ul>

<p>This way if the user creates a Pod without specifying <code>spec.ServiceAccountName</code>, by default it will use <code>default</code> service-account from Pod's namespace. </p>

<p>You can even set for the <code>default service account</code> the same permissions as for the <code>user account</code>. The only difference would be that <code>service accounts</code> exist in the <em>specific namespace</em>.</p>

<p>If you need to use the same namespace for all users, you can use <a href="https://helm.sh/docs/howto/charts_tips_and_tricks/" rel="nofollow noreferrer">helm charts</a> to set the correct <code>serviceAccountName</code> for each user <em>( imagine you have service-accounts with the same name as users )</em> by using <a href="https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing" rel="nofollow noreferrer">--set</a> command line arguments as follows: </p>

<pre><code>$ cat testchart/templates/job.yaml 
...
   serviceAccountName: {{ .Values.saname }}
...

$ export SANAME=$(kubectl config view --minify -o jsonpath='{.users[0].name}')
$ helm template ./testchart --set saname=$SANAME
---
# Source: testchart/templates/job.yaml
...
   serviceAccountName: kubernetes-admin
...
</code></pre>

<p>You can also specify <code>namespace</code> for each user in the same way.</p>
