Create kubeconfig from service account

create-kubeconfig-from-service-account.sh

#!/bin/bash

set -o errexit
set -o nounset
set -o pipefail

# ensure service account exists
kubectl apply -f - >&2 <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-sa
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-sa-admin-binding
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admin
subjects:
- kind: ServiceAccount
  name: my-sa
  namespace: default
EOF

secret_name=$(kubectl get sa my-sa -n default -o=jsonpath='{.secrets[0].name}')

token=$(kubectl get secret -n default ${secret_name} -o 'jsonpath={.data.token}' | base64 -d)
ca_crt=$(kubectl get secret -n default ${secret_name} -o 'jsonpath={.data.ca\.crt}')

cat <<EOF
kind: Config
preferences:
  colors: true
current-context: cluster
apiVersion: v1
clusters:
- cluster:
    server: https://my-host
    certificate-authority-data: ${ca_crt}
  name: cluster
contexts:
- context:
    cluster: cluster
    user: cluster
  name: cluster
users:
- name: cluster
  user:
    token: ${token}
EOF