service-account-to-kubeconfig

gistfile1.txt

# your server name goes here
server=https://<your apiserver address>:6443 
# the name of the secret containing the service account token goes here
name=crd-reader-sa-token-rz5xp
# namespace to use, set NAMESPACE_OVERRIDE to use other namespace
namespace=${NAMESPACE_OVERRIDE:=default}
ca=$(kubectl get secret/$name -o jsonpath='{.data.ca\.crt}' -n $namespace)
token=$(kubectl get secret/$name -o jsonpath='{.data.token}' -n $namespace | base64 --decode)
namespace=$(kubectl get secret/$name -o jsonpath='{.data.namespace}' -n $namespace | base64 --decode)

echo "
apiVersion: v1
kind: Config
clusters:
- name: default-cluster
  cluster:
    certificate-authority-data: ${ca}
    server: ${server}
contexts:
- name: default-context
  context:
    cluster: default-cluster
    namespace: default
    user: default-user
current-context: default-context
users:
- name: default-user
  user:
    token: ${token}
" > sa.kubeconfig