# Why are the secret content of the default serveraccount are mounted inside the pod?

**URL:** <https://discuss.kubernetes.io/t/why-are-the-secret-content-of-the-default-serveraccount-are-mounted-inside-the-pod/17528>\
**Category:** General Discussions\
**Created:** [September 24, 2021, 7:28am UTC](https://discuss.kubernetes.io/t/why-are-the-secret-content-of-the-default-serveraccount-are-mounted-inside-the-pod/17528 "2021-09-24T07:28:26Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![4k1l](https://avatars.discourse-cdn.com/v4/letter/4/6bbea6/32.png) [@4k1l](https://discuss.kubernetes.io/u/4k1l)\
**Post date:** [September 24, 2021, 7:28am UTC](https://discuss.kubernetes.io/t/why-are-the-secret-content-of-the-default-serveraccount-are-mounted-inside-the-pod/17528/1 "2021-09-24T07:28:26Z")

</div>

When a new namespace is created in kubernetes the ServiceAccount contoller and Token controller create a default service account and a corresponding ServiceAccount token Secret to allow API access.

```auto

apiVersion: v1
items:
- apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: default
    namespace: dev
  secrets:
  - name: default-token-lrvlp # secret used by the service account
- apiVersion: v1
  data:
    ca.crt: $CA
    namespace: ZGV2
    token: $TOKEN
  kind: Secret
  metadata:
    annotations:
      kubernetes.io/service-account.name: default
    name: default-token-lrvlp
    namespace: dev
  type: kubernetes.io/service-account-token
kind: List

```

When a pod is created the controller configures the pod to use the serviceAccount. All good till now. But it also mounts the secret contents inside the pod:

```auto
  serviceAccountName: default
  volumes:
  - name: kube-api-access-fcdwf
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt
            path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:
          - fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
            path: namespace

```

The pod is already authenticated as a default Service Account which uses the secret. So why is the secret mounted again inside the pod ?