Upon creating a service account, it seems to be getting access to all resources by default (as if it gets a copy of all my permissions). This is on GKE.

Are Service Accounts supposed to have default access to resources (upon SA creation), or am I missing something?

As per bitnami guide, service account by default will not have access to any resource until it is assigned Roles/ClusterRoles via respective bindings.

This is a simple bash script I'm running to depict the issue I'm seeing.

original_context=ehealth-dev
kubectl create sa eugene-test --context $original_context
sa_secret=$(kubectl get sa eugene-test  --context $original_context -o json | jq -r .secrets[].name)
kubectl get secret --context $original_context $sa_secret -o json | jq -r '.data["ca.crt"]' | base64 -D > /tmp/my_ca.crt
user_token=$(kubectl get secret --context $original_context $sa_secret -o json | jq -r '.data["token"]' | base64 -D)
original_cluster_name=my_long_cluster_name
endpoint=`kubectl config view -o jsonpath="{.clusters[?(@.name == \"$original_cluster_name\")].cluster.server}"`

kubectl config set-credentials my_user --token=$user_token
kubectl config set-cluster my_cluster \
  --embed-certs=true \
  --server=$endpoint \
  --certificate-authority=/tmp/my_ca.crt
kubectl config set-context my_context \
  --cluster=my_cluster \
  --user=my_user \
  --namespace=default

kubectl config use-context my_context
kubectl get pods -n my_namespace                          # ------ it works! :-(
kubectl delete sa eugene-test --context $original_context
kubectl config delete-cluster my_cluster