<p>Is possible to gain k8s cluster access with serviceaccount token?</p>
<p>My script does not have access to a kubeconfig file, however, it does have access to the service account token at /var/run/secrets/kubernetes.io/serviceaccount/token.</p>
<p>Here are the steps I tried but it is not working.</p>
<ol>
<li>kubectl config set-credentials sa-user --token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)</li>
<li>kubectl config set-context sa-context --user=sa-user</li>
</ol>
<p>but when the script ran &quot;kubectl get rolebindings&quot; I get the following error:
Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User &quot;system:serviceaccount:test:default&quot; cannot list resource &quot;rolebindings&quot; in API group &quot;rbac.authorization.k8s.io&quot; in the namespace &quot;test&quot;</p>

<blockquote>
<p>Is possible to gain k8s cluster access with serviceaccount token?</p>
</blockquote>
<p>Certainly, that's the point of a ServiceAccount token. The question you appear to be asking is &quot;why does my <code>default</code> ServiceAccount not have all the privileges I want&quot;, which is a different problem. One will benefit from reading <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions" rel="nofollow noreferrer">the fine manual on the topic</a></p>
<p>If you want the <code>default</code> SA in the <code>test</code> NS to have privileges to read things in its NS, you must create a Role scoped to that NS and then declare the relationship explicitly. SAs do not automatically have those privileges</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: test
  name: test-default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: whatever-role-you-want
subjects:
- kind: ServiceAccount
  name: default
  namespace: test
</code></pre>
<blockquote>
<p>but when the script ran &quot;kubectl get pods&quot; I get the following error: Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User &quot;system:serviceaccount:test:default&quot; cannot list resource &quot;rolebindings&quot; in API group &quot;rbac.authorization.k8s.io&quot; in the namespace &quot;test&quot;</p>
</blockquote>
<p>Presumably you mean you can <code>kubectl get rolebindings</code>, because I would not expect running <code>kubectl get pods</code> to emit that error</p>
