<p>I have the following pod definition, (notice the explicitly set <strong>service account</strong> and <strong>secret</strong>):</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: pod-service-account-example
  labels:
    name: pod-service-account-example
spec:
  serviceAccountName: example-sa
  containers:
  - name: busybox
    image: busybox:latest
    command: ["sleep", "10000000"]
    env:
      - name: SECRET_KEY
        valueFrom:
          secretKeyRef:
            name: example-secret
            key: secret-key-123
</code></pre>

<p>It successfully runs. However if I use the the same service account <code>example-sa</code>, and try to retrieve the <code>example-secret</code> it fails:</p>

<pre><code>kubectl get secret example-secret
Error from server (Forbidden): secrets "example-secret" is forbidden: User "system:serviceaccount:default:example-sa" cannot get resource "secrets" in API group "" in the namespace "default"
</code></pre>

<hr>

<p>Does RBAC not apply for pods? Why is the pod able to retrieve the secret if not?</p>

Chris Stryczynski
<p>RBAC applies to service accounts, groups, users and not to pods.When you refer a secret in the env of a pod , service account is not being used to get the secret.Kubelet is getting the secret by using its own kubernetes client credential. Since kubelet is using its own credential to get the secret it does not matter whether the service account has RBAC to get secret or not because its not used.</p>

<p>Service account is used when you want to invoke Kubernetes API from a pod using kubernetes standard client library or Kubectl.</p>

<p><a href="https://github.com/kubernetes/kubernetes/blob/2bacdf8047482da89b14e679c65ab61e0486553b/pkg/kubelet/kubelet_pods.go#L719" rel="nofollow noreferrer">Code snippet</a> of Kubelet for reference. </p>
