Glossary
Service account
A Kubernetes identity for workloads and automation, authenticated with bearer tokens and shown in audit logs as system:serviceaccount:<namespace>:<name>.
A service account is a namespaced Kubernetes object that gives Pods and automation an identity. Pods receive a token for their service account, mounted by default under /var/run/secrets/kubernetes.io/serviceaccount/. In the audit log, requests made with it appear as system:serviceaccount:<namespace>:<name>.
Because tokens can be copied out of a pod, a service account used from an internet address, with kubectl or curl, or for pods/exec is a classic sign of theft. See secrets access and service account token theft and the official documentation.