Create SA,Role,Rolebinding for a development namespace on K8s

developer-permissions.yaml

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Namespace
metadata:
  name: developer
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: developer-sa
  namespace: developer
---
apiVersion: v1
kind: Secret
metadata:
  name: developer-sa-secret
  namespace: developer
  annotations:
    kubernetes.io/service-account.name: developer-sa
type: kubernetes.io/service-account-token
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: developer-role
  namespace: developer
rules:
# - apiGroups: ["apps"]
#   resources: ["deployments"]
#   verbs: ["get", "list", "watch", "create", "delete", "update", "patch","attach", "logs"]

# - apiGroups: [""] # "" indicates the core API group
#   resources: ["configmaps", "secrets","delete"]
#   verbs: ["get", "list", "watch", "create", "delete", "update", "patch" ,"attach"]

# - apiGroups: [""] # "" indicates the core API group
#   resources: ["pods"]
#   verbs: ["get", "list", "watch", "create", "delete", "update", "patch", "attach" , "logs"]

# - apiGroups: [""]
#   resources: ["pods/log"]
#   verbs: ["get", "list", "watch", "create", "delete", "update", "patch", "attach" , "logs"]

- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: developer-rolebinding
  namespace: developer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: developer-role
subjects:
- kind: ServiceAccount
  name: developer-sa
  namespace: developer
EOF

export serviceAccount=developer-sa
export namespace=developer
export secretName=developer-sa-secret
export name=node1


kubectl get secret $secretName -n $namespace -o custom-columns=CA:'.data.ca\.crt' --no-headers | base64 -d > ca.crt

export userToken=$(kubectl get secret $secretName -n $namespace -o custom-columns=CA:'.data.token' --no-headers | base64 -d)

export endpoint=$(kubectl config view -o yaml | grep server | awk '{print $2 }')

kubectl config --kubeconfig=config-demo set-cluster development

kubectl config --kubeconfig=config-demo set-cluster development \
  --embed-certs=true \
  --server=$endpoint \
  --certificate-authority=./ca.crt

kubectl config --kubeconfig=config-demo set-credentials $serviceAccount --

kubectl config --kubeconfig=config-demo \
    set-context developer-namespace --cluster=development \
    --user $serviceAccount --namespace $namespace