Kubernetes service accounts, and creating kubeconfig for one

on a new release.

"But I already have a kubeconfig that I use with kubectl, managing the cluster"

). You know, better safe than sorry.

A service account, a role and a role binding

For the GitHub actions deploying WebGazer on the cluster case, my configuration is similar to this:

ServiceAccount and its token secret

apiVersion: v1

kind: ServiceAccount

metadata:

  name: webgazer-github

  namespace: default

serviceaccount-webgazer-github.yaml

apiVersion: v1

kind: Secret

metadata:

  annotations:

    kubernetes.io/service-account.name: webgazer-github

  name: webgazer-github-token

  namespace: default

type: kubernetes.io/service-account-token

secret-webgazer-github.yaml

Before version 1.24, Kubernetes created secret for the service account automatically. But after 1.24, we manually need to create a secret.

's to install that plugin, which is the most popular kubectl package I know. I used homebew to install krew:

$ brew install krew

To see other methods you can use to install krew, head over to krew's installation docs.

Once you have krew installed, you can install view-serviceaccount-kubeconfig plugin, too:

$ kubectl krew install view-serviceaccount-kubeconfig

And then you can use the plugin to create the kubeconfig:

$ kubectl view-serviceaccount-kubeconfig \

  --namespace default \

  webgazer-github

And it will output the kubeconfig's content. You can use that kubeconfig wherever you need to access the cluster with the service account you created.