<p>Curious as to how configMaps can be referenced in PODs without appropriate serviceAccount and asscoiated RBAC rules ?</p>
<p><strong>Sample POD Yaml mounting configMap</strong></p>
<pre><code>    - mountPath: /kubernetes-vault
      name: kubernetes-vault

       .................
       .................

          volumes:
      - emptyDir: {}
        name: vault-token
      - configMap:
          defaultMode: 420
          name: kubernetes-vault
    name: kubernetes-vault
</code></pre>
<p>But the <code>associated ServiceAccount and it's corresponding RBAC ( Role and RoleBinding )</code> does'nt have any rules specifying access rules for this <code>configMap (kubernetes-vault)</code></p>
<p><strong>Role &amp; Rule for the POD</strong></p>
<pre><code>rules:
- apiGroups:
  - '*'
  resources:
  - services
  - pods
  - endpoints
  verbs:
  - get
  - list
  - watch
</code></pre>
<p><strong>Couple of Qs</strong></p>
<ul>
<li>does'nt access to configMap required appropriate ServiceAccount with access rules specified specifically for configMap access ?</li>
<li>if yest which rule mentioned above governs configMap Access</li>
<li>if not , what objects are governed by RBAC rules ?</li>
</ul>

Shashi
<blockquote>
<p>doesn't access to configMap required appropriate ServiceAccount with access rules specified specifically for configMap access ?</p>
</blockquote>
<p>It will when a <code>ServiceAccount</code> is performing that action, yes, but <code>volumes:</code> are performed by a mixture of <code>kube-apiserver</code>, <code>kube-controller</code>, and the calling credential that interacts with the apiserver. By the time the Pod's volumes mount, all those security checks are a done deal -- one can verify that behavior by running any Pod and suppressing its <code>ServiceAccount</code> and observe that the volume mounts still take place</p>
<p>If one has objects which should only be accessed by a limited set of users, that should happen at the Role level to prevent the users from scheduling Pods that touch the sensitive items.</p>
<blockquote>
<p>if not , what objects are governed by RBAC rules ?</p>
</blockquote>
<p>As far as I know, <em>everything</em> is governed by RBAC rules, and even if they aren't to your satisfaction, the system offers <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook" rel="nofollow noreferrer">Validating Admission Controllers</a> which allow <strong>extremely</strong> fine-grained access rules</p>
