Kubernetes Service Account Name

This page explains how to use the Kubernetes Service Account Name identifier to uniquely identify workloads deployed on Kubernetes.

Understanding the Kubernetes service account name identifier

In Kubernetes, service accounts provide an identity for processes that run in a pod. You can assign each pod a service account, and the pod uses this account when it interacts with the Kubernetes API or other services.

Using the service account name as an identifier is useful when you want to manage Access Policies tied to the identity of workloads, rather than their namespace or pod name.

Applicable deployment type

Aembit supports the Kubernetes Service Account Name identification method for Edge-based deployments on Kubernetes.

Create a Client Workload with a Kubernetes service account name identifier

To configure a Client Workload with a Kubernetes Service Account Name identifier, follow these steps:

1. Log into your Aembit Tenant.

2. Click Client Workloads in the left nav pane.

3. Click New, revealing the Client Workload pop out menu.

4. Enter the Name and optional Description for the Client Workload.

5. Under Client Identification, select Kubernetes Service Account Name.

   For Value, enter the name of the Kubernetes Service Account used by the workload.

   For example, if your service account is app-sa, enter that in the Value field.

   If you don’t know the service account name or how to find it, see Find Kubernetes Service Account Name.

6. Click Save.

   Aembit displays the new Client Workload on the Client Workloads page.

Client Workload identifier uniqueness

When you identify a Client Workload using a single identifier such as this one in a complex environment, this identifier may not always provide sufficient uniqueness.

To avoid Aembit unintentionally matching something beyond what it’s intended to match, Aembit recommends that you set additional identifiers to compliment this one, creating a Client Workload identity that’s unique across your environment.

See Using multiple Client Workload identifiers for guidance on combining this identifier with more specific identifiers such as those on the Client Workload Identifiers overview page, which includes vendor- and technology-specific identifiers.

Find Kubernetes service account name

To find the Kubernetes Service Account Name used by a workload, follow these steps:

Note

You can also find the service account name in the Kubernetes deployment YAML files, Helm chart values, or other IaC configurations.

Be sure to enter the service account name exactly as it appears in your Kubernetes cluster.

1. Use the command: kubectl get serviceaccount -n <namespace>

2. Locate the service account associated with your workload in the output.

3. Use the value in the NAME column as the identifier in your Aembit configuration.