{
  "id": "serviceaccount-pod",
  "title": "ServiceAccount for Pod API Access",
  "category": "Cluster Administration",
  "difficulty": "Medium",
  "type": "task",
  "weight": 7,
  "description": "## ServiceAccount for Pod API Access\n\nServiceAccounts provide an identity for pods that need to interact with the Kubernetes API (e.g., operators, CI runners, custom controllers).\n\n**Your task:**\n\n1. Create a ServiceAccount named `api-reader` in the `default` namespace\n2. Create a Pod named `api-pod` using `nginx:alpine` that uses the `api-reader` ServiceAccount\n\n```bash\n# Verify:\nkubectl get pod api-pod -o jsonpath='{.spec.serviceAccountName}'\n```",
  "hints": [
    {
      "title": "Create a ServiceAccount",
      "body": "ServiceAccounts are namespace-scoped resources. Use `kubectl create serviceaccount`.",
      "command": "kubectl create serviceaccount api-reader"
    },
    {
      "title": "Assign ServiceAccount to a Pod",
      "body": "Set `spec.serviceAccountName` in the pod spec.",
      "command": "cat <<EOF | kubectl apply -f -\napiVersion: v1\nkind: Pod\nmetadata:\n  name: api-pod\nspec:\n  serviceAccountName: api-reader\n  containers:\n  - name: app\n    image: nginx:alpine\nEOF"
    }
  ],
  "setup_commands": [],
  "validation": {
    "commands": [
      {
        "description": "ServiceAccount 'api-reader' exists",
        "command": "kubectl get serviceaccount api-reader -o jsonpath='{.metadata.name}'",
        "expected_output": "api-reader",
        "match": "exact"
      },
      {
        "description": "Pod 'api-pod' uses api-reader ServiceAccount",
        "command": "kubectl get pod api-pod -o jsonpath='{.spec.serviceAccountName}'",
        "expected_output": "api-reader",
        "match": "exact"
      },
      {
        "description": "Pod 'api-pod' is Running",
        "command": "kubectl get pod api-pod -o jsonpath='{.status.phase}'",
        "expected_output": "Running",
        "match": "exact"
      }
    ]
  },
  "default_namespace": "default",
  "teardown_commands": [
    {
      "command": "kubectl delete serviceaccount api-reader --ignore-not-found"
    },
    {
      "command": "kubectl delete pod api-pod --ignore-not-found --grace-period=0 --force"
    }
  ]
}