<p>I have the following deployment spec:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: sa-dep-non-root 
spec:
  selector:
    matchLabels:
      app: sa-dep-non-root # has to match .spec.template.metadata.labels
  #replicas: 3 # by default is 1
  template:
    metadata:
      labels:
        app: sa-dep-non-root # has to match .spec.selector.matchLabels
    spec:
      serviceAccountName: simon-sa
      securityContext:
        runAsUser: 1000
      tolerations:
      - key: &quot;type&quot;
        operator: &quot;Equal&quot;
        value: &quot;ops&quot;
        effect: &quot;NoSchedule&quot;
      containers:
      - name: sa-dep-non-root
        image: k8s.gcr.io/nginx-slim:0.8
        ports:
        - containerPort: 80
          name: sa-dep-non-root
</code></pre>
<p>The deployment and its corresponding pods gets created properly when running:
<code>kubectl apply -f simon-sa-deployment-non-root.yaml -n test-ns</code>
I was not expecting this to work, as I am setting the serviceAccountName to <code>simon-sa</code> which does not have permissions to create pods:</p>
<pre><code>Simons-MBP:test simon$ kubectl  --as=system:serviceaccount:test-ns:simon-sa auth can-i create pods -n test-ns
no

</code></pre>
<p>My understanding is that when no <code>serviceAccountName</code> is specified, then it's the k8s controller manager (through some clusterrolebindings with the correct permissions like system:controller:replicaset-controller) the one that creates the pods, and it's not actually my own user in which I am authenticated the one that creates the pods for that deployment.</p>
<p>My other understanding is that this behavior can be overriden when specifying <code>serviceAccountName</code> in the pod definition. In this case, the pods are not created by the controller manager, but instead for the specified serviceAccountName. Since the serviceAccountName that I specified does not have permissions to create pods, this should have failed. Do I have the concepts mixed here?</p>

Simon Ernesto Cardenas Zarate
<p><code>ServiceAccounts</code> are permissions for the pod, what you are doing is assigning this permission to the pod you are instantiating in the deployment, so <code>kubectl apply -f simon-sa-deployment-non-root.yaml -n test-ns</code> will use the permissions that your user is logged in with <code>kubectl</code> api server, so if you do a <code>kubectl auth can-i create deployments --namespace test-ns</code> it will return Yes.</p>
<p>So maybe what you are trying to do is create an user that will have read only access to the cluster which is done with cluster roles and not service account which are scoped to pods.</p>
<p>Or let me know what is you are trying to do and i can explain</p>
