Using service accounts in applications

A service account is an OpenShift Container Platform account that allows a component to directly access the API. Service accounts are API objects that exist within each project. Service accounts provide a flexible way to control API access without sharing a regular user’s credentials.

When you use the OpenShift Container Platform CLI or web console, your API token authenticates you to the API. You can associate a component with a service account so that they can access the API without using a regular user’s credentials. For example, service accounts can allow:

Each service account’s user name is derived from its project and name:

Every service account is also a member of two groups:

Each service account automatically contains two secrets:

The generated API token and registry credentials do not expire, but you can revoke them by deleting the secret. When you delete the secret, a new one is automatically generated to take its place.

Your OpenShift Container Platform cluster contains default service accounts for cluster management and generates more service accounts for each project.

You can create a service account in a project and grant it permissions by binding it to a role.

You can distribute a service account’s token to external applications that must authenticate to the API.

In order to pull an image, the authenticated user must have get rights on the requested imagestreams/layers. In order to push an image, the authenticated user must have update rights on the requested imagestreams/layers.

By default, all service accounts in a project have rights to pull any image in the same project, and the builder service account has rights to push any image in the same project.