Service accounts are a different story. Each pod has a service account associated with it, and all the workloads running in this pod use that service account as their identity. Service accounts are scoped to a namespace. When you create a pod (directly or via a deployment), you may specify a service account. If you create a pod without specifying a service account, then the namespace's default service account is used. Each service account has a secret associated with it for talking to the API server.
The following block shows the default service account in the default namespace:
$ kubectl get sa default -o yamlapiVersion: v1kind: ServiceAccountmetadata: creationTimestamp: 2019-01-11T15:49:27Z name: default namespace: default ...
