Service Account
Identity for pods to authenticate against the Kubernetes API + external systems. Distinct from User Account (humans). Every namespace has a default SA; best practice is a dedicated SA per workload with minimal RBAC.
Token mounted as a projected volume at /var/run/secrets/kubernetes.io/serviceaccount/. Since v1.22: bound tokens with expiry (short-lived, auto-rotated). Pre-v1.22: secret objects with eternal JWTs (security hole if the secret leaks). IRSA (IAM Roles for Service Accounts) — AWS feature, SA token used to assume an IAM role via OIDC. Workload Identity Federation: Google Cloud + Azure have similar. Eliminates long-lived cloud creds in pods. Standard pattern for "least privilege" in Kubernetes.