Service Account

Let's create a service account for CI/CD activities in a new namespace.

Namespace

---
apiVersion: v1
kind: Namespace
metadata:
  name: my-namespace

ServiceAccount

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: buzz
  namespace: my-namespace

Role

---
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: my-namespace
  name: buzz-role
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
  resources: ["services", "configmaps", "secrets"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

RoleBinding

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: buzz-binding
  namespace: my-namespace
subjects:
- kind: ServiceAccount
  name: buzz
  namespace: my-namespace
roleRef:
  kind: Role
  name: buzz-role
  apiGroup: rbac.authorization.k8s.io

Token and KubeConfig (OmnI)

Get the token for the service account:

kubectl create token buzz -n my-namespace

When using Omni, you can get the service account kubeconfig using:

omnictl kubeconfig --service-account -c <cluster-name> --user buzz /tmp/buzz-kubeconfig.yaml