# 1. Create a service account
#
#    kubectl create serviceaccount test-account
# 
# 2. Bind the cluster-admin role to that SA
#    
#    kubectl create clusterrolebinding test-account --clusterrole=cluster-admin --serviceaccount=default:test-account
#
# 3. Deploy the pod
# 
#    kubectl create -f service-account.yaml
#
# 4. Get secrets - you will see a secret for the service account.
#
# 5. Exec into the pod and see the token
#
#    kubectl exec -ti sa-pod -- sh
#
# 6. In the container's shell look at the generated JWT token
#
#    cat /var/run/secrets/kubernetes.io/serviceaccount/token
#
# 7. You can copy the token and decode it using jwt.io to see its contents.
apiVersion: v1
kind: Pod
metadata:
  name: sa-pod
spec:
  serviceAccountName: "test-account"
  containers:
  - name: sa-pod
    image: nginx