使用来自不同命名空间的 Kubernetes 服务帐户

Question

I have created a service account SA1 in namespace NS1 and set a full configuration for SA1 (workload identity in GCP). I need to use the service account SA1 in pods from different namespaces. for now I have the pods in namespace NS1 using the SA1

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
  namespace: NS1
spec:
  serviceAccountName: SA1

Answer 1

ServiceAccount is a namespaced resource in Kubernetes, meaning that it can only be referenced from pods deployed in the same namespace.

This is by design, Namespaces act as logical containers on which you apply access policies and a pod in one namespace should not be able to "steal" the serviceaccount from another (possibly unrelated) namespace