How to: ServiceAccount permissions
The Default RBAC policies grant scoped permissions to control-plane components, nodes, and controllers, but grant no permissions to service accounts outside the kube-system namespace (beyond discovery permissions given to all authenticated users).

There are [different ServiceAccount permission approaches](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions), but we will only go over two:

- Grant a role to an application-specific service account (**best practice**)
  - requires the `serviceAccountName` specified in the pod spec, and for the ServiceAccount to have been created
- Grant a role to the `default` service account in a namespace
  - permissions given to the `default` service account are available to any pod in the namespace that does not specify a `serviceAccountName`. **This is a security concern in live environments without RBAC**

```sh