<p>When I am using the command <code>kubectl</code> with the <code>--token</code> flag and specify a token, it still uses the administrator credentials from the <code>kubeconfig</code> file.</p>
<p>This is what I did:</p>
<pre><code>NAMESPACE=&quot;default&quot;
SERVICE_ACCOUNT_NAME=&quot;sa1&quot;
kubectl create sa $SERVICE_ACCOUNT_NAME
kubectl create clusterrolebinding list-pod-clusterrolebinding \
     --clusterrole=list-pod-clusterrole \
     --serviceaccount=&quot;$NAMESPACE&quot;:&quot;$SERVICE_ACCOUNT_NAME&quot;
kubectl create clusterrole list-pod-clusterrole \
     --verb=list \
     --resource=pods

TOKEN=`kubectl get secrets $(kubectl get sa $SERVICE_ACCOUNT_NAME -o json | jq -r '.secrets[].name') -o json | jq -r '.data.token' | base64 -d`

# Expected it will fail but it doesn't because it uses the admin credentials
kubectl get secrets --token $TOKEN

</code></pre>
<p>The token have permissions to list pods, so I expect the <code>kubectl get secrets --token $TOKEN</code> to fail but it doesn't because it still uses the context of the administrator.</p>
<p>I don't create new context, I know <code>kubectl</code> have this ability to use bearer token and want to understand how to do it.</p>
<p>I also tried this <code>kubectl get secrets --insecure-skip-tls-verify --server https://&lt;master_ip&gt;:6443 --token $TOKEN</code>and it also didn't return a <code>Forbidden</code> result.</p>
<p>If you test it you can use katacoda:<br />
<a href="https://www.katacoda.com/courses/kubernetes/playground" rel="nofollow noreferrer">https://www.katacoda.com/courses/kubernetes/playground</a></p>
<p><strong>EDIT:</strong></p>
<p>I tried to create context with this:</p>
<pre><code>NAMESPACE=&quot;default&quot;
SERVICE_ACCOUNT_NAME=&quot;sa1&quot;
CONTEXT_NAME=&quot;sa1-context&quot;
USER_NAME=&quot;sa1-username&quot;
CLUSTER_NAME=&quot;kubernetes&quot;

kubectl create sa &quot;$SERVICE_ACCOUNT_NAME&quot; -n &quot;$NAMESPACE&quot;
SECRET_NAME=`kubectl get serviceaccounts $SERVICE_ACCOUNT_NAME -n $NAMESPACE -o json | jq -r '.secrets[].name'`
TOKEN=`kubectl get secrets $SECRET_NAME -n $NAMESPACE -o json | jq -r '.data | .token' | base64 -d`

# Create user with the JWT token of the service account
echo &quot;[*] Setting credentials for user: $USER_NAME&quot;
kubectl config set-credentials $USER_NAME --token=$TOKEN

# Makue sure the cluster name is correct !!!
echo &quot;[*] Setting context: $CONTEXT_NAME&quot;
kubectl config set-context $CONTEXT_NAME \
--cluster=$CLUSTER_NAME \
--namespace=$NAMESPACE \
--user=$USER_NAME
</code></pre>
<p>But when I tried <code>kubectl get secrets --context $CONTEXT_NAME</code> it still succeeded and was supposed fail because it doesn't have permissions for that.</p>
<p><strong>Edit 2:</strong><br />
Option to run it correctly based on the <a href="https://kubernetes.io/docs/reference/kubectl/kubectl/" rel="nofollow noreferrer">kubectl API</a>:</p>
<pre><code>kubectl get pods --token `cat /home/natan/token` -s https://&lt;ip&gt;:8443 --certificate-authority /root/.minikube/ca.crt --all-namespaces
</code></pre>
<p>Or without TLS:</p>
<pre><code>kubectl get pods --token `cat /home/natan/token` -s https://&lt;ip&gt;:8443 --insecure-skip-tls-verify --all-namespaces
</code></pre>

<p>This is tricky because if you are using client certificate for authenticating to kubernetes API server overriding token with kubectl is not going to work because the authentication with certificate happens early in the process during the TLS handshake.Even if you provide a token in kubectl it will be ignored.This is the reason why you are able to get secrets because the client certificate have permission to get secrets and the token is ignored.</p>

<p>So if you want to use kubectl token the kubeconfig file should not have client certificate and then you can override that token with <code>--token</code> flag in Kubectl. See the discussion in the <a href="https://stackoverflow.com/questions/47770676/how-to-create-a-kubectl-config-file-for-serviceaccount">question</a> on how to create a kubeconfig file for a service account token.</p>

<p>Also you can view the bearer token being sent in kubectl command using command</p>

<pre><code>kubectl get pods --v=10 2&gt;&amp;1 | grep -i bearer
</code></pre>
