Goal

Limit API access from Pods using ServiceAccounts, token mounts and RBAC.

What Is Done

The lab creates a Pod without an automatically mounted token and a Job with a ServiceAccount, Role and RoleBinding for reading Pods.

Typical Commands

kubectl apply -f manifests/
kubectl auth can-i list pods --as=system:serviceaccount:api-access-lab:pod-reader -n api-access-lab
kubectl logs -n api-access-lab job/api-reader
kubectl describe pod -n api-access-lab no-token

Validate Success

• pod-reader can list Pods.
• The Job can show Pods in the namespace.
• Pod no-token has no automatically mounted ServiceAccount token.

Common Mistakes

• automountServiceAccountToken: false is forgotten.
• The RoleBinding references the wrong namespace.
• kubectl auth can-i is checked without --as.