<p>I want to create a role to service account with context.<br>
My goal is to be able to run <code>kubectl get pods</code> with the context of the service account.  </p>

<p>To do it I need:</p>

<ol>
<li>Create service account</li>
<li>Create role</li>
<li>Create bind role</li>
<li>Create context</li>
</ol>

<p>I created a service account:  </p>

<pre><code>kubectl create serviceaccount myservice
</code></pre>

<p><strong>Role.yaml:</strong>  </p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata: 
  namespace: development
  name: my-role
rules: 
- apiGroups: ["", "extensions", "apps"]
  resources: ["pods"]
  verbs: ["get"] 
</code></pre>

<p><strong>BindRole.yaml:</strong>  </p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata: 
  name: my-role-binding
  namespace: development
subjects: 
- kind: ServiceAccount 
  name: myservice
  namespace: development
  apiGroup: ""
roleRef: 
  kind: Role
  name: my-role
  apiGroup: ""
</code></pre>

<p>I want to be able to run <code>kubectl get pods</code> in the context of the service account <code>myservice</code>.  </p>

<p>To create context I need something like that:  </p>

<pre><code>kubectl config set-context myservice-context --cluster=kubernetes --user=???
</code></pre>

<p>But I can't use <code>--user</code> for the service account.<br>
So how can I do it ?  </p>

<p>I thought to use <code>kubectl config set-credentials</code> but it just creates a user and I already have the service account.  </p>

<p>EDIT:<br>
Here is my try to create a user with the token of the service account and then use it with <code>kubectl --context=myservice-context get pods</code> but it failed:<br>
<a href="https://i.stack.imgur.com/DxARm.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/DxARm.png" alt="enter image description here"></a></p>

<p>It appears the cluster maybe missing from your <code>~/.kube/config</code> file. If it were a permissions issue, I would expect to see either <code>error: You must be logged in to the server (Unauthorized)</code> or <code>Error from server (Forbidden)</code>.</p>

<p>The error you are seeing <code>The connection to the server localhost:8080 was refused - did you specify the right host or port?</code> implies that there is no cluster with the name you specified in your kubeconfig.</p>

<p>I'd check that your kubeconfig includes the cluster name <code>kubernetes</code> with <code>certificate-authority-data</code> and respective <code>server</code>.</p>

<p>For example here is me attempting with non-existent service account first with an invalid cluster, then again with a cluster that does exist in my <code>kubeconfig</code>.</p>

<p>Bad cluster name:</p>

<pre><code>kubectl config set-context service-context \
--cluster=doesnotexist \
&gt; --namespace=default \
&gt; --user=service-account
Context "service-context" modified.
➜  ~ kubectl --context=service-context get pods
The connection to the server localhost:8080 was refused - did you specify the right host or port?
</code></pre>

<p>Good cluster name:</p>

<pre><code>kubectl config set-context service-context \
--cluster=exists \
--namespace=default \
--user=service-account
Context "service-context" modified.
➜  ~ kubectl --context=service-context get pods
error: You must be logged in to the server (Unauthorized)
</code></pre>

<p>The later error would suggest there was something wrong with your user/permissions. The former would suggest the <code>cluster</code> does not exist in your <code>kubeconfig</code>.</p>

<p>EDIT:</p>

<p>Also remember when you use <code>sudo</code> its using <code>/root/.kube/config</code> which may not be what you want</p>
