Red Hat OpenShift Container Platform

Default service accounts

Your Red Hat OpenShift Container Platform cluster contains default service accounts for cluster management and generates more service accounts for each project.

Default cluster service accounts

Several infrastructure controllers run using service account credentials. The following service accounts are created in the Red Hat OpenShift Container Platform infrastructure project (openshift-infra) at server start, and given the following roles cluster-wide:

Service account Description

Service account	Description
`replication-controller`	Assigned the `system:replication-controller` role
`deployment-controller`	Assigned the `system:deployment-controller` role
`build-controller`	Assigned the `system:build-controller` role. Additionally, the `build-controller` service account is included in the privileged security context constraint to create privileged build pods.

replication-controller

Assigned the system:replication-controller role

deployment-controller

Assigned the system:deployment-controller role

build-controller

Assigned the system:build-controller role. Additionally, the build-controller service account is included in the privileged security context constraint to create privileged build pods.

Default project service accounts and roles

Three service accounts are automatically created in each project:

Service account Usage

builder

Used by build pods. It is given the system:image-builder role, which allows pushing images to any imagestream in the project using the internal Docker registry.

The builder service account is not created if the Build cluster capability is not enabled.

deployer

Used by deployment pods and given the system:deployer role, which allows viewing and modifying replication controllers and pods in the project.

The deployer service account is not created if the DeploymentConfig cluster capability is not enabled.

default

Used to run all other pods unless they specify a different service account.

Access rights and security privileges tied to the default service account apply to every pod in the project that does not specify a different service account. To implement the principle of least privilege and improve auditability, create dedicated service accounts for your workloads instead of using the default service account.

While most Red Hat OpenShift Container Platform platform components and Operators use dedicated service accounts, the following dynamic tools continue to use the default service account to ensure operational efficiency:

oc debug: Uses the default service account to avoid the performance overhead of creating and removing unique service accounts for short-lived troubleshooting sessions.
oc adm must-gather: Uses the default service account to collect diagnostic data across the cluster without requiring extensive manual RBAC modifications.

All service accounts in a project are given the system:image-puller role, which allows pulling images from any image stream in the project using the internal container image registry.