Kubernetes serviceaccount is essential for our team members to access the Kubernetes Cluster remotely. It provides a credential called a "token" that is used to authorize the cluster. This page will showcase how to create a new serviceaccount for a new user on Kubernetes.

1. To create a new service account, the current serviceaccount must have the superuser or cluster root access. 
2. If you have an account, and want to check if you have root access to create accounts. You can:
   1. Normally, if the current service account has the clusterrole of cluster-admin, it should have the root access.
   2. To check cluster roles, type :clusterroles on K9s;
   3. To check if the current service account has cluster-admin privilege, type :clusterrolebindings in k9s, then find service-account-admins in the default namespace. You can see if the current serviceaccount name is under the Subjects attribute.
3. Otherwise, you need root access to create accounts (the root user can access /etc/rancher/k3s/k3s.yaml, so never ever modify this file!!!). To gain root access, you can:
   1. SSH into EC2 as ubuntu and login to root by sudo -i
   2. Or login to the administrator on the Linux server by typing in su - administrator and enter the password (pwd stored in Box file login secrets).
4. To add a new serviceaccount, type the following in a command line interface. It should create a service account under the default namespace.

   kubectl create serviceaccount <serviceaccount name>

5. If you encounter authorization failure or errors when running the above command, please review the Kubernetes failure Diagnosis.
6. To generate a token for this serviceaccount, type the following in the command line interface having the cluster root access. This will generate a secret under the default namespace with the name <serviceaccount name>

   kubectl apply -f - <<EOF apiVersion: v1 kind: Secret metadata: name: <serviceaccount name> annotations: kubernetes.io/service-account.name: <serviceaccount name> type: kubernetes.io/service-account-token EOF

7. Now, we have the new serviceaccount and its token created. By using this token, the user should be able to connect to our Kubernetes Clusters. To see how to connect to Kubernetes Clusters, check How to connect to the server.
8. In order for the new user to have full access to the kubernetes cluster, we need to add the user to the current clusterrolebindings. Simply type :clusterrolebindings in k9s, then find service-account-admins in the default namespace. Press 'e' to edit the YAML file. At the end of the file, append the following under the Subject attribute.

   - kind: ServiceAccount name: <serviceaccount name> namespace: default

9. Now the new user should be able to access all components in our Kubernetes cluster. To see how to connect to Kubernetes Clusters, check How to connect to the server.