<p>I'd like to be able to detect inactive Service accounts and User accounts by using <strong>kubectl</strong> / <strong>rest api</strong> in my Kubernetes cluster.</p>
<p>like for an example idle service account that has not been used for any resource for x days and it's safe to delete it.
<BR>
or a user account that didn't access the cluster for the last x days.</p>

Yaron Avital
<p>I don't believe this functionality comes out of the box for <code>ServiceAccounts</code> or <code>Users</code>, unfortunately. One way you might be able to check, is by reading the <code>api-server</code> <a href="https://kubernetes.io/docs/tasks/debug/debug-cluster/#looking-at-logs" rel="nofollow noreferrer">logs</a> and checking if you can find authentication entries for these &quot;subjects&quot; (as they are called in k8s jargon).</p>
<p>Additionally, you can enable <a href="https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/" rel="nofollow noreferrer">audit logging</a> in k8s to be able to detect such activities. But I believe you'll have to parse the logs yourself, through an application to be able to determine which accounts are unused or safe to be deleted.</p>
