Secrets, service accounts and narrow identity

The mechanism

A Secret object is intended for confidential data, but its base64 representation is encoding, not encryption. Actual protection depends on access controls, storage encryption configuration and how the workload consumes the value. A user able to read the Secret can usually recover its contents.

A ServiceAccount represents workload identity for Kubernetes API access. It does not automatically need broad permissions. If ParcelOps only serves synthetic data and never calls the API, it should not receive an API token merely by habit.

Avoid placing real secrets in manifests, logs, screenshots or this handbook’s examples. Reference an approved secret-delivery mechanism in a real deployment and verify rotation and revocation behavior. Secret availability and application reload remain distinct concerns.

Worked example

This offline Pod-spec fragment disables automatic ServiceAccount token mounting for a workload that does not need the Kubernetes API. It contains no secret value. Whether additional credentials are needed depends on the real application, not this fixture.

serviceAccountName: parcelops-reader
automountServiceAccountToken: false
containers:
  - name: api
    image: registry.example/parcelops/api:reviewed-version
    env:
      - name: FIXTURE_MODE
        value: "true"

Practice: predict, inspect, explain

Offline exercise. List the identities involved in pulling an image, reading the Kubernetes API and contacting an external database. Explain why one credential should not be reused for all three. Then decide what access a user gains if they can create a Pod that mounts a namespace Secret.

Expected observation: permission to create workloads can indirectly expose data available to those workloads. Review effective capability, not only direct get secrets permission. Keep token and secret values absent from the evidence packet; record references and policy decisions instead.

Troubleshooting and trade-offs

If a workload receives a 403 from the API, inspect its intended identity and RBAC rather than granting cluster-admin. If a token is unexpectedly mounted, review ServiceAccount and Pod settings. If rotating a Secret does not change application behavior, inspect its consumption and reload mechanism. Never use decoded secret output as routine debugging evidence.

Interview practice

Completion check

Produce an identity map with no credential values and justify whether the application needs an API token.

Sources and version notes

Baseline checked 6 October 2026: the official release page lists Kubernetes 1.37.1. Verify your cluster and distribution prerequisites. All manifests are offline teaching examples; no cluster mutations or cloud resources are executed by this handbook.

• Official documentation: Secret
• Official documentation: Service accounts
• Official documentation: Rbac
• Official documentation: Overview