informations

$ kubectl get -n kube-system secret
NAME                    TYPE                                  DATA   AGE
default-token-2kmsr     kubernetes.io/service-account-token   3      3m11s
gitlab-ci-token-jlc58   kubernetes.io/service-account-token   3      118s
# In this case the ServiceAccount token Secret is named `gitlab-ci-token-jlc58`,
# the name of the Secret will differ between clusters (it will always start with `gitlab-ci-token-`)
$ kubectl get -n kube-system secret gitlab-admin-token-jvt8w -o yaml
apiVersion: v1
data:
  ca.crt: [REDACATED]
  namespace: [REDACATED]
  token: [BASE64_ENCODED_TOKEN_HERE]
kind: Secret
metadata:
[...]
  name: gitlab-ci-token-jlc58
  namespace: kube-system
[...]
type: kubernetes.io/service-account-token

$ echo BASE64_ENCODED_TOKEN_HERE | base64 -d
YOUR_DECODED_TOKEN
# Long cryptic looking output, copy it.

$ echo BASE64_ENCODED_CA_CERT_HERE | base64 -d
YOUR_BASE64_DECODED_CA_CERT_HERE

# Looks something like this:
-----BEGIN CERTIFICATE-----
[REDACATED]
-----END CERTIFICATE-----