添加服务帐户后，默认情况下它将获取所有权限

Question

Upon creating a service account, it seems to be getting access to all resources by default (as if it gets a copy of all my permissions). This is on GKE.

Are Service Accounts supposed to have default access to resources (upon SA creation), or am I missing something?

As per bitnami guide , service account by default will not have access to any resource until it is assigned Roles/ClusterRoles via respective bindings.

This is a simple bash script I'm running to depict the issue I'm seeing.

original_context=ehealth-dev
kubectl create sa eugene-test --context $original_context
sa_secret=$(kubectl get sa eugene-test  --context $original_context -o json | jq -r .secrets[].name)
kubectl get secret --context $original_context $sa_secret -o json | jq -r '.data["ca.crt"]' | base64 -D > /tmp/my_ca.crt
user_token=$(kubectl get secret --context $original_context $sa_secret -o json | jq -r '.data["token"]' | base64 -D)
original_cluster_name=my_long_cluster_name
endpoint=`kubectl config view -o jsonpath="{.clusters[?(@.name == \"$original_cluster_name\")].cluster.server}"`

kubectl config set-credentials my_user --token=$user_token
kubectl config set-cluster my_cluster \
  --embed-certs=true \
  --server=$endpoint \
  --certificate-authority=/tmp/my_ca.crt
kubectl config set-context my_context \
  --cluster=my_cluster \
  --user=my_user \
  --namespace=default

kubectl config use-context my_context
kubectl get pods -n my_namespace                          # ------ it works! :-(
kubectl delete sa eugene-test --context $original_context
kubectl config delete-cluster my_cluster

Answer 1

Early versions of GKE enabled static authorization that gave all service accounts full API permissions. That is no longer the default as of 1.8.

Versions prior to 1.8 can disable this permissive permission with the --no-enable-legacy-authorization flag to gcloud