<p>I want to create service account for native Kubernetes cluster so that I can send API calls:</p>
<pre><code>kubernetes@kubernetes1:~$ kubectl create serviceaccount user1
serviceaccount/user1 created
kubernetes@kubernetes1:~$ kubectl create clusterrole nodeaccessrole --verb=get --verb=list --verb=watch --resource=nodes
clusterrole.rbac.authorization.k8s.io/nodeaccessrole created
kubernetes@kubernetes1:~$ kubectl create clusterrolebinding nodeaccessrolebinding --serviceaccount=default:user1 --clusterrole=nodeaccessrole
clusterrolebinding.rbac.authorization.k8s.io/nodeaccessrolebinding created
kubernetes@kubernetes1:~$
kubernetes@kubernetes1:~$ kubectl get serviceaccount user1
NAME    SECRETS   AGE
user1   0         7m15s
kubernetes@kubernetes1:~$
</code></pre>
<p>Do you know how I can get the token?</p>
<p><em><strong>SOLUTION for v1.25.1:</strong></em></p>
<pre><code>kubectl create sa cicd

kubectl get sa,secret


cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: cicd
spec:
  serviceAccount: cicd
  containers:
  - image: nginx
    name: cicd
EOF




kubectl exec cicd -- cat /run/secrets/kubernetes.io/serviceaccount/token &amp;&amp; echo

kubectl exec cicd cat /run/secrets/kubernetes.io/serviceaccount/token &amp;&amp; echo


kubectl create token cicd

kubectl create token cicd --duration=999999h



cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
  name: cicd
  annotations:
    kubernetes.io/service-account.name: &quot;cicd&quot;
EOF



kubectl get sa,secret

kubectl  describe secret cicd

kubectl   describe sa cicd

kubectl   get sa cicd -oyaml

kubectl   get sa,secret
</code></pre>
<p>One thing is not clear:</p>
<pre><code>kubectl exec cicd -- cat /run/secrets/kubernetes.io/serviceaccount/token &amp;&amp; echo
    
kubectl exec cicd cat /run/secrets/kubernetes.io/serviceaccount/token &amp;&amp; echo
</code></pre>
<p>should I use '--' into the above commands?</p>

Peter Penzov
<p>If you just want to retrieve the token from the given SA you can simply execute:</p>
<pre><code>kubectl get secret $(kubectl get sa &lt;sa-name&gt; -o jsonpath='{.secrets[0].name}' -n &lt;namespace&gt;) -o jsonpath='{.data.token}' -n &lt;namespace&gt; | base64 --decode
</code></pre>
<p>Feel free to remove the <code>| base64 --decode</code> if you don't want to decode. Just as a side node, this command might need to be amended depending on the type of secret, however for your use-case this should work</p>
<p>Once you have your value you can execute curl commands, such as:</p>
<pre><code>curl -k -H &quot;Authorization: Bearer $TOKEN&quot; -X GET &quot;https://&lt;KUBE-API-IP&gt;:6443/api/v1/nodes&quot;
</code></pre>
