<p>As far as i know the default service account in Kubernetes should not have any permissions assigned. But still I can perform following from the pod on my docker desktop k8s:</p>
<pre><code>APISERVER=https://kubernetes.default.svc
SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount
NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace)
TOKEN=$(cat ${SERVICEACCOUNT}/token)
CACERT=${SERVICEACCOUNT}/ca.crt
curl --cacert ${CACERT} --header &quot;Authorization: Bearer ${TOKEN}&quot; -X GET ${APISERVER}/api/v1/pods
</code></pre>
<p>How is that posible?</p>
<p>Furhermore I discovered that each pod have a different value of the SA token (<code>cat /var/run/secrets/kubernetes.io/serviceaccount/token</code>) and different from the one returned by <code>kubectl describe secret default-token-cl9ds</code>
Shouldn't it be the same?</p>
<p><strong>Update:</strong></p>
<pre><code>$ kubectl get rolebindings.rbac.authorization.k8s.io podviewerrolebinding -o yaml                                                                                              
apiVersion: rbac.authorization.k8s.io/v1                                                                                                                                       
kind: RoleBinding                                                                                                                                                              
metadata:                                                                                                                                                                      
  annotations:                                                                                                                                                                 
    kubectl.kubernetes.io/last-applied-configuration: |                                                                                                                        
      {&quot;apiVersion&quot;:&quot;rbac.authorization.k8s.io/v1&quot;,&quot;kind&quot;:&quot;RoleBinding&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;name&quot;:&quot;podviewerrolebinding&quot;,&quot;namespace&quot;:&quot;default&quot;},&quot;roleRef&quot;:{&quot;apiGroup&quot;
:&quot;rbac.authorization.k8s.io&quot;,&quot;kind&quot;:&quot;Role&quot;,&quot;name&quot;:&quot;podviewerrole&quot;},&quot;subjects&quot;:[{&quot;kind&quot;:&quot;ServiceAccount&quot;,&quot;name&quot;:&quot;podviewerserviceaccount&quot;}]}                                    
  creationTimestamp: &quot;2021-09-07T10:01:51Z&quot;                                                                                                                                    
  name: podviewerrolebinding                                                                                                                                                   
  namespace: default                                                                                                                                                           
  resourceVersion: &quot;402212&quot;                                                                                                                                                    
  uid: 2d32f045-b172-4fff-a6b0-1525b0b96e65                                                                                                                                    
roleRef:                                                                                                                                                                       
  apiGroup: rbac.authorization.k8s.io                                                                                                                                          
  kind: Role                                                                                                                                                                   
  name: podviewerrole                                                                                                                                                          
subjects:                                                                                                                                                                      
- kind: ServiceAccount                                                                                                                                                         
  name: podviewerserviceaccount                                                                                                                                                
</code></pre>

Marcin
<p>I hit the same issue, it looks like docker desktop has elevated permissions (i.e. admin) by default, see the article <a href="https://github.com/docker/for-mac/issues/3694" rel="nofollow noreferrer">here</a>.</p>
<p>Removing the clusterrolebinding docker-for-desktop-binding via the following command fixes the issue.</p>
<pre><code>kubectl delete clusterrolebinding docker-for-desktop-binding
</code></pre>
