<p>I am having issues with service accounts. I created a service account and then created .key and .crt using this guide:</p>

<p><a href="https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/" rel="nofollow noreferrer">https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/</a></p>

<p>I used <code>cluster_ca.key</code> and <code>cluster_ca.crt</code> from <code>KOPS_STATE_STORE</code> bucket (since I used <code>kops</code> to create the cluster) to create user <code>ca.crt</code> and <code>ca.key</code>. Then I got token from secret.</p>

<p>I set the context like this:</p>

<pre><code>kubectl config set-cluster ${K8S_CLUSTER_NAME} --server="${K8S_URL}" --embed-certs=true --certificate-authority=./ca.crt
kubectl config set-credentials gitlab-telematics-${CI_COMMIT_REF_NAME} --token="${K8S_TOKEN}"
kubectl config set-context telematics-dev-context --cluster=${K8S_CLUSTER_NAME} --user=gitlab-telematics-${CI_COMMIT_REF_NAME}
kubectl config use-context telematics-dev-context
</code></pre>

<p>When I do the deployment using that service account token I get the following error:</p>

<pre><code>error: unable to recognize "deployment.yml": Get https://&lt;CLUSTER_ADDRESS&gt;/api?timeout=32s: x509: certificate signed by unknown authority
</code></pre>

<p>The Service Account, Role and RoleBinding YAML:</p>

<pre><code>---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-telematics-dev
  namespace: telematics-dev

---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: telematics-dev-full-access
  namespace: telematics-dev
rules:
  - apiGroups: ["", "extensions", "apps"]
    resources: ["deployments", "replicasets", "pods", "services"]
    verbs: ["*"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: telematics-dev-view
  namespace: telematics-dev
subjects:
  - kind: ServiceAccount
    name: gitlab-telematics-dev
    namespace: telematics-dev
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: telematics-dev-full-access
</code></pre>

<p>The generated <code>kubeconfig</code> looks fine to me:</p>

<pre><code>apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: &lt;REDACTED&gt;
    server: https://&lt;CLUSTER_ADDRESS&gt;
  name: &lt;CLUSTER_NAME&gt;
contexts:
- context:
    cluster: &lt;CLUSTER_NAME&gt;
    user: gitlab-telematics-dev
  name: telematics-dev-context
current-context: telematics-dev-context
kind: Config
preferences: {}
users:
- name: gitlab-telematics-dev
  user:
    token: &lt;REDACTED&gt;
</code></pre>

<p>I managed to solve this. Sorry for the late answer. Posting this in case someone else is facing the same issue.</p>

<p>The following line is not needed:</p>

<p><code>kubectl config set-cluster ${K8S_CLUSTER_NAME} --server="${K8S_URL}" --embed-certs=true --certificate-authority=./ca.crt</code></p>

<p>As we are issuing tokens, only the token can be used.</p>
