Pivoting off a semi-privileged service account within a cluster