helm_charthelm_releasehelm_templatehelm_template_renderedhelm_valuekubernetes_cluster_rolekubernetes_cluster_role_bindingkubernetes_config_mapkubernetes_cronjobkubernetes_custom_resource_definitionkubernetes_daemonsetkubernetes_deploymentkubernetes_endpointkubernetes_endpoint_slicekubernetes_eventkubernetes_horizontal_pod_autoscalerkubernetes_ingresskubernetes_jobkubernetes_limit_rangekubernetes_namespacekubernetes_network_policykubernetes_nodekubernetes_persistent_volumekubernetes_persistent_volume_claimkubernetes_podkubernetes_pod_disruption_budgetkubernetes_pod_security_policykubernetes_pod_templatekubernetes_replicasetkubernetes_replication_controllerkubernetes_resource_quotakubernetes_rolekubernetes_role_bindingkubernetes_secretkubernetes_servicekubernetes_service_accountkubernetes_stateful_setkubernetes_storage_classkubernetes_{custom_resource_singular_name}
Table: kubernetes_service_account
In Kubernetes, service accounts are used to provide an identity for pods. Pods that want to interact with the API server will authenticate with a particular service account. By default, applications will authenticate as the default service account in the namespace they are running in.
Examples
Basic Info - kubectl get serviceaccounts --all-namespaces columns
select name, namespace, jsonb_array_length(secrets) as secrets, age(current_timestamp, creation_timestamp)from kubernetes_service_accountorder by namespace, name;List role bindings
select sub ->> 'name' as service_account_name, sub ->> 'namespace' as service_account_namespace, name as role_binding, role_name, role_kindfrom kubernetes_role_binding, jsonb_array_elements(subjects) as subwhere sub ->> 'kind' = 'ServiceAccount';List cluster role bindings and rules
select crb.name as cluster_role_binding, crb.role_name, crb_sub ->> 'name' as service_account_name, crb_sub ->> 'namespace' as service_account_namespace, cr_rule ->> 'apiGroups' as rule_api_groups, cr_rule ->> 'resources' as rule_resources, cr_rule ->> 'verbs' as rule_verbs, cr_rule ->> 'resourceNames' as rule_resource_namesfrom kubernetes_cluster_role_binding as crb, jsonb_array_elements(subjects) as crb_sub, kubernetes_cluster_role as cr, jsonb_array_elements(cr.rules) as cr_rulewhere cr.name = crb.role_name and crb_sub ->> 'kind' = 'ServiceAccount';List manifest resources
select name, namespace, jsonb_array_length(secrets) as secrets, pathfrom kubernetes_service_accountwhere path is not nullorder by namespace, name;Query examples
- pods_for_service_account
- role_bindings_for_service_account
- roles_for_service_account
- secrets_for_service_account
- service_account_annotations
- service_account_automount_token
- service_account_default_namespace
- service_account_input
- service_account_labels
- service_accounts_for_cluster_role
- service_accounts_for_pod
- service_accounts_for_role
.inspect kubernetes_service_account
A service account provides an identity for processes that run in a Pod.
| Name | Type | Description |
|---|---|---|
| _ctx | jsonb | Steampipe context in JSON form, e.g. connection_name. |
| annotations | jsonb | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. |
| automount_service_account_token | boolean | Indicates whether pods running as this service account should have an API token automatically mounted. Can be overridden at the pod level. |
| context_name | text | Kubectl config context name. |
| creation_timestamp | timestamp with time zone | CreationTimestamp is a timestamp representing the server time when this object was created. |
| deletion_grace_period_seconds | bigint | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. |
| deletion_timestamp | timestamp with time zone | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. |
| end_line | bigint | The path to the manifest file. |
| finalizers | jsonb | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. |
| generate_name | text | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. |
| generation | bigint | A sequence number representing a specific generation of the desired state. |
| image_pull_secrets | jsonb | List of references to secrets in the same namespace to use for pulling any images in pods that reference this ServiceAccount. ImagePullSecrets are distinct from Secrets because Secrets can be mounted in the pod, but ImagePullSecrets are only accessed by the kubelet. |
| labels | jsonb | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. |
| name | text | Name of the object. Name must be unique within a namespace. |
| namespace | text | Namespace defines the space within which each name must be unique. |
| owner_references | jsonb | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. |
| path | text | The path to the manifest file. |
| resource_version | text | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. |
| secrets | jsonb | Secrets is the list of secrets allowed to be used by pods running using this ServiceAccount. |
| source_type | text | The source of the resource. Possible values are: deployed and manifest. If the resource is fetched from the spec file the value will be manifest. |
| start_line | bigint | The path to the manifest file. |
| tags | jsonb | A map of tags for the resource. This includes both labels and annotations. |
| title | text | Title of the resource. |
| uid | text | UID is the unique in time and space value for this object. |