A ServiceAccount is the Kubernetes workload identity used by a Pod, controller, or operator when it talks to the Kubernetes API. It is not a user account; it is a machine identity that gets permissions through RBAC rules such as Roles, ClusterRoles, and their bindings.
This matters because any process running with that ServiceAccount inherits its API privileges. If a controller is over-permissioned, compromise of that workload can let an attacker read Secrets, modify resources, or create new Pods with broader reach. In attacks, ServiceAccounts are often the starting point for lateral movement and privilege escalation; in defense, they are a key place to enforce least privilege. Good practice is to assign one ServiceAccount per workload, avoid using the default account, scope permissions to the minimum needed, and regularly review bindings for unnecessary cluster-wide access.