# CKS-017 — Remove unnecessary ServiceAccount tokens

Domain: **2.2 Service-account safety**  
Time: **5 minutes** · Score: **Section B only**

## Existing workload

```yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: reporter
  namespace: jobs
spec:
  schedule: "*/10 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: reporter
            image: registry.example.com/reporter:2.1
          restartPolicy: Never
```

## Task

The workload does not use the Kubernetes API. Create a dedicated ServiceAccount named `reporter`, disable token automounting on it, and update the complete CronJob Pod template to use it and explicitly disable token automounting. Verify the ServiceAccount and CronJob settings.

## Section B — scored answer

```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: reporter
  namespace: jobs
automountServiceAccountToken: false
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: reporter
  namespace: jobs
spec:
  schedule: "*/10 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: reporter
          automountServiceAccountToken: false
          containers:
          - name: reporter
            image: registry.example.com/reporter:2.1
          restartPolicy: Never
```

```bash
k create sa reporter -n jobs --dry-run=client -o yaml > reporter-sa.yaml
kubectl apply -f reporter-sa.yaml
```

Say **Grade CKS-017** when saved.