<p>My team recently found out that the <code>default</code> service account, managed by K8S and associated by default to pods, had full read and write permissions in the cluster. We could list secrets from the running pods, create new pods....</p>
<p>We found this strange, as we thought the <code>default</code> service account had no permissions whatsoever or even just read permissions. So we decided to search through the cluster for role bindings or cluster role bindings associated with that service account, but we could find none.</p>
<p>In a K8S cluster, doesn't the <code>default</code> service account have a basic role binding associated with it? Why don't we have any? And if we don't have any, why does the service account have full permissions on the cluster, instead of none at all? Lastly, how can we modify it so it has no permissions in the cluster?</p>
<p>Just to make it clear: we have multiple namespaces in our cluster, each one having its own <code>default</code> service account. However, none of them have any role bindings associated with them and they all have full cluster permissions.</p>

Tiago Silva
<p>Apparently, by default, kops sets up clusters with the K8S API server authorization mode set to <code>AlwaysAllow</code>, meaning any request, as long as it is successfully authenticated, has global admin permissions.</p>
<p>In order to fix this, we had to change the authorization mode to <code>RBAC</code> and manually tweak the permissions.</p>
<p>Thank you to <a href="https://stackoverflow.com/users/12747111/arthur-busser">@ArthurBusser</a> for pointing it out!</p>
