How to: Service Accounts
Just as user accounts identifies humans, a service account identifies processes running in a Pod.

- Service Accounts are the recommended way to authenticate to the API server within the k8s cluster
- A Pod created without specifying a ServiceAccount is automatically assigned the `default` ServiceAccount
- When a new ServiceAccount is created, a Secret is auto-created to hold the credentials required to access the API server
- The ServiceAccount credentials of a Pod are automounted with the Secret in each container within the Pod at:
  - token `/var/run/secrets/kubernetes.io/serviceaccount/token`
  - certificate (if available) `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`
  - default namespace `/var/run/secrets/kubernetes.io/serviceaccount/namespace`
- You can opt out of automounting API credentials for a ServiceAccount by setting `automountServiceAccountToken: false` on the ServiceAccount. Note that the pod spec takes precedence over the service account if both specify a `automountServiceAccountToken` value