A platform engineer is tasked with ensuring that an application can securely access the Kubernetes API without using a developer’s personal credentials. What is the correct way to configure this?

The standard and most secure method for an in-cluster application to access the Kubernetes API is by using a ServiceAccount. A ServiceAccount provides a distinct identity for the application within the cluster. This identity is then granted specific, fine-grained permissions via Role-Based Access Control (RBAC) using Roles and RoleBindings. This adheres to the principle of least privilege, ensuring the application has only the permissions it needs and avoids the use of static, long-lived user credentials, which is a significant security risk.

B. While a ServiceAccount token is used, simply "generating a certificate" is an incomplete and imprecise description of the Kubernetes-native mechanism.
C. Using a developer's kubeconfig file is a security anti-pattern; it distributes user credentials and makes auditing and revocation difficult.
D. The default ServiceAccount typically has very limited permissions for security reasons. Relying on it is not a best practice; a dedicated account should be created.

1. Kubernetes Documentation, "Configure Service Accounts for Pods". The documentation states: "When you create a pod, if you do not specify a service account, it is automatically assigned the default service account... For pod-to-API-server access, you should create a dedicated service account and grant it the minimal set of permissions required." (kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/)

2. Kubernetes Documentation, "Accessing the Cluster". This page details the recommended approach: "When accessing the API from a pod, using a service account is the recommended way." It explains how the token is automatically mounted into the pod. (kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod)

3. Red Hat OpenShift Documentation, "Understanding and creating service accounts". The guide explains: "Service accounts are used to provide an identity for processes that run in a pod... You can grant permissions to a service account by binding it to a role." (docs.openshift.com/container-platform/4.12/authentication/understanding-and-creating-service-accounts.html)