<p>The API credentials for service accounts are normally mounted in pods as:</p>
<pre><code>/var/run/secrets/kubernetes.io/serviceaccount/token
</code></pre>
<p>This token allows containerized processes in the pod to communicate with the API server.</p>
<p>What's the purpose of a pod's service account (<code>serviceAccountName</code>), if <code>automountServiceAccountToken</code> is set to <code>false</code>?</p>

Shuzheng
<p><strong>A little of theory:</strong></p>
<p>Let's start with what happens when pod should be created.</p>
<blockquote>
<p>When you create a pod, if you do not specify a service account, it is
automatically assigned the default service account in the same
namespace</p>
</blockquote>
<p><a href="https://v1-24.docs.kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server" rel="noreferrer">Reference</a>.</p>
<p>So all pods are linked to service account anyway (default or specified in <code>spec</code>).</p>
<p>Then API access token is always generated for each service account.</p>
<p><code>automountServiceAccountToken</code> flag defines if this token will automatically mounted to the pod after it has been created.</p>
<p>There are two options where to set this flag:</p>
<ul>
<li><p>In a specific service account</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: build-robot
automountServiceAccountToken: false
...
</code></pre>
</li>
<li><p>In a specific pod</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  serviceAccountName: build-robot
  automountServiceAccountToken: false
  ...
</code></pre>
</li>
</ul>
<hr />
<p><strong>Answer:</strong></p>
<blockquote>
<p>What's the purpose of a pod's service account (serviceAccountName), if
automountServiceAccountToken is set to false?</p>
</blockquote>
<p>It may make a difference depending on what processes are involved in pod creation. Good example is in <a href="https://github.com/kubernetes/kubernetes/issues/16779#issuecomment-159656641" rel="noreferrer">comments in GitHub issue</a> (where this flag eventually came from):</p>
<blockquote>
<p>There are use cases for still creating a token (for use with external
systems) or still associating a service account with a pod (for use
with image pull secrets), but being able to opt out of API token
automount (either for a particular pod, or for a particular service
account) is useful.</p>
</blockquote>
