<p>I want all of my pods to have the <em>same</em> kubernetes service account token so that my caching proxy views all requests from a single deployment as equivalent.</p>
<p>I've always taken it for granted that I'll get these service account tokens automatically made in the kubernetes namespace with a random string at the end like:</p>
<p><code>service-account-token-qrs88x</code></p>
<p>I thought this would automount <em>this</em> token into all of my pods, but it seems like every pod gets their own token.</p>
<p>I can create a token for which I have a dependable name, but I was wondering if I could save myself some extra configuration by using these automatically generated token Secrets as part of a deployment instead of each pod getting their own token.</p>
<p>What is the point of <code>service-account-token-qrs88x</code> if I can't reliably use it inside a pod?</p>

Breedly
<blockquote>
<p>I thought this would automount this token into all of my pods, but it seems like every pod gets their own token.</p>
</blockquote>
<p>No, every <strong>namespace</strong> got only <code>default</code>, its might be your deployment that creates a random service account.</p>
<p>The default service account is bound to every in the namespace, so you can assign permission to the default pod and as this is already used by the pod inside the namespace.</p>
<pre><code>kubectl create rolebinding default-view \
  --clusterrole=view \
  --serviceaccount=default:default \
  --namespace=default
</code></pre>
<p>this is just example, you can assign base on your need.</p>
<p>Every Kubernetes installation has a service account called default that is associated with every <strong>running pod</strong>. Similarly, to enable pods to make calls to the internal API Server endpoint, there is a ClusterIP service called Kubernetes. This combination makes it possible for internal processes to call the API endpoint.</p>
<p>The default secret mount to <code>/tmp/secrets/kubernetes.io/serviceaccount/token</code></p>
<p>So if you want to use service token for example, that service account allow service to use <strong>AWS s3,</strong> or some <strong>GCP service</strong>, then you should create another service and allow pod to use that service.</p>
<p>this will create service account named <code>myserviceaccount</code></p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: myserviceaccount
  annotations:
   eks.amazonaws.com/role-arn: {{ .Values.ses_role_arn }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ include &quot;helm-chart.name&quot; . }}
    helm.sh/chart: {{ include &quot;helm-chart.chart&quot; . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
</code></pre>
<p>and the pod should reference this service account</p>
<pre><code>    spec:
      imagePullSecrets:
        - name: {{ include &quot;helm-chart.fullname&quot; . }}
      volumes:
        - name: heap-dumps
          emptyDir: {}
      serviceAccountName: myserviceaccount    
      containers:.....
</code></pre>
<p><a href="https://i.stack.imgur.com/jaQ7T.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/jaQ7T.png" alt="enter image description here" /></a>
<a href="https://i.stack.imgur.com/sfjWM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/sfjWM.png" alt="enter image description here" /></a></p>
<p>Or you can consume the token as env from the default service token, so you will not relay on the token name.</p>
<pre><code>
apiVersion: v1
kind: Secret
metadata:
  name: default-token
  annotations:
    kubernetes.io/service-account.name: default
type: kubernetes.io/service-account-token
---
apiVersion: v1
kind: Pod
metadata:
  name: secret-env-pod
spec:
  containers:
  - name: mycontainer
    image: nginx
    env:
      - name: KUBERNETES_TOKEN
        valueFrom:
          secretKeyRef:
            name: default-token
            key: token
  restartPolicy: Never

</code></pre>
