<p>Whats the best approach to provide a .kube/config file in a rest service deployed on kubernetes?</p>

<p>This will enable my service to (for example) use the kuberntes client api.</p>

<p>R</p>

<p>Create service account:</p>

<pre><code>kubectl create serviceaccount example-sa
</code></pre>

<p>Create a role:</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: example-role
rules:
- apiGroups: [""] # "" indicates the core API group
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
</code></pre>

<p>Create role binding:</p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: example-role-binding
  namespace: default
subjects:
  - kind: "ServiceAccount"
    name: example-sa
roleRef:
  kind: Role
  name: example-role
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>create pod using <code>example-sa</code></p>

<pre><code>kind: Pod
apiVersion: v1
metadata:
 name: example-pod
spec:
 serviceAccountName: example-sa
 containers:
 - name: secret-access-container
   image: example-image
</code></pre>

<p>The most important line in pod definition is <code>serviceAccountName: example-sa</code>. After creating service account and adding this line to your pod's definition you will be able to access your api access token at <code>/var/run/secrets/kubernetes.io/serviceaccount/token</code>.</p>

<p><a href="https://developer.ibm.com/recipes/tutorials/service-accounts-and-auditing-in-kubernetes/" rel="nofollow noreferrer">Here</a> you can find a little bit more detailed version of the above example.</p>
