<p>I wish to run a <a href="https://www.drone.io/" rel="nofollow noreferrer">Drone</a> CI/CD pipeline on a Raspberry Pi, including a stage to update a Kubernetes Deployment. Unfortunately, all the pre-built solutions that I've found for doing so (<a href="https://github.com/sinlead/drone-kubectl" rel="nofollow noreferrer">e.g. 1</a>, <a href="https://github.com/honestbee/drone-kubernetes" rel="nofollow noreferrer">e.g. </a>) are not built for <code>arm64</code> architecture, so I believe I need to build my own.</p>
<p>I am attempting to adapt the commands from <a href="https://github.com/sinlead/drone-kubectl/blob/master/init-kubectl" rel="nofollow noreferrer">here</a> (see also <a href="https://github.com/sinlead/drone-kubectl" rel="nofollow noreferrer">README.md</a>, which describes the authorization required), but my attempt to contact the cluster still fails with authorization problems:</p>
<pre class="lang-bash prettyprint-override"><code>$ cat service-account-definition.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: drone-demo-service-account
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: drone-demo-service-account-clusterrolebinding
subjects:
  - kind: ServiceAccount
    name: drone-demo-service-account
    namespace: default
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

$ kubectl apply -f service-account-definition.yaml
serviceaccount/drone-demo-service-account created
clusterrolebinding.rbac.authorization.k8s.io/drone-demo-service-account-clusterrolebinding created

$ kubectl get serviceaccount drone-demo-service-account
NAME                         SECRETS   AGE
drone-demo-service-account   1         10s

$ kubectl get secret $(kubectl get secrets | grep 'drone-demo-service-account-token' | cut -f1 -d' ') -o jsonpath='{.data.ca\.crt}' &gt; secrets/cert

$ head -c 10 secrets/cert
LS0tLS1CRU%

$ kubectl get secret $(kubectl get secrets | grep 'drone-demo-service-account-token' | cut -f1 -d' ') -o jsonpath='{.data.token}' | base64 &gt; secrets/token

$ head -c 10 secrets/token
WlhsS2FHSk%

$ cat Dockerfile
FROM busybox

COPY . .
CMD [&quot;./script.sh&quot;]

$ cat script.sh
#!/bin/sh

server=$(cat secrets/server) # Pre-filled
cert=$(cat secrets/cert)
# Added this `tr` call, which is not present in the source I'm working from, after noticing that
# the file-content contains newlines
token=$(cat secrets/token | tr -d '\n')

echo &quot;DEBUG: server is $server, cert is $(echo $cert | head -c 10)..., token is $(echo $token | head -c 10)...&quot;

# Cannot depend on the binami/kubectl image (https://hub.docker.com/r/bitnami/kubectl), because
# it's not available for arm64 - https://github.com/bitnami/charts/issues/7305
wget https://storage.googleapis.com/kubernetes-release/release/v1.19.2/bin/linux/arm64/kubectl
chmod +x kubectl
./kubectl config set-credentials default --token=$token
echo $cert | base64 -d &gt; ca.crt
./kubectl config set-cluster default --server=$server --certificate-authority=ca.crt
./kubectl config set-context default --cluster=default --user=default
./kubectl config use-context default
echo &quot;Done with setup, now cat-ing .kube/config&quot;
echo
cat $HOME/.kube/config
echo &quot;Attempting to get pods&quot;
echo
./kubectl get pods

$ docker build -t stack-overflow-testing . &amp;&amp; docker run stack-overflow-testing
Sending build context to Docker daemon  10.75kB
Step 1/3 : FROM busybox
 ---&gt; 3c277069c6ae
Step 2/3 : COPY . .
 ---&gt; 74c6a132d255
Step 3/3 : CMD [&quot;./script.sh&quot;]
 ---&gt; Running in dc55f33f74bb
Removing intermediate container dc55f33f74bb
 ---&gt; dc68a5d6ba9b
Successfully built dc68a5d6ba9b
Successfully tagged stack-overflow-testing:latest
DEBUG: server is https://rassigma.avril:6443, cert is LS0tLS1CRU..., token is WlhsS2FHSk...
Connecting to storage.googleapis.com (142.250.188.16:443)
wget: note: TLS certificate validation not implemented
saving to 'kubectl'
kubectl               18% |*****                           | 7118k  0:00:04 ETA
kubectl               43% |*************                   | 16.5M  0:00:02 ETA
kubectl               68% |**********************          | 26.2M  0:00:01 ETA
kubectl               94% |******************************  | 35.8M  0:00:00 ETA
kubectl              100% |********************************| 38.0M  0:00:00 ETA
'kubectl' saved
User &quot;default&quot; set.
Cluster &quot;default&quot; set.
Context &quot;default&quot; created.
Switched to context &quot;default&quot;.
Done with setup, now cat-ing .kube/config

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /ca.crt
    server: https://rassigma.avril:6443
  name: default
contexts:
- context:
    cluster: default
    user: default
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: default
  user:
    token: WlhsS2FHSkhZM[...REDACTED]
Attempting to get pods

error: You must be logged in to the server (Unauthorized)
</code></pre>
<p>If I copy the <code>~/.kube/config</code> from my laptop to the docker container, <code>kubectl</code> commands succeed as expected - so, this isn't a networking issue, just an authorization one. I do note that my laptop-based <code>~/.kube/config</code> lists <code>client-certificate-data</code> and <code>client-key-data</code> rather than <code>token</code> under <code>users: user:</code>, but I suspect that's because my base config is recording a non-service-account.</p>
<p>How can I set up <code>kubectl</code> to authorize as a service account?</p>
<p>Some reading I have done that didn't answer the question for me:</p>
<ul>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">kubenetes documentation on AuthN/AuthZ</a></li>
<li><a href="https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts" rel="nofollow noreferrer">Google Kubernetes Engine article on service accounts</a></li>
<li><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer">Configure Service Accounts for Pods</a> (this described how to create and associate the accounts, but not how to act as them)</li>
<li>Two blog posts (<a href="https://medium.com/the-programmer/working-with-service-account-in-kubernetes-df129cb4d1cc_" rel="nofollow noreferrer">1</a>, <a href="https://www.magalix.com/blog/building-a-cd-pipeline-with-drone-ci-and-kubernetes" rel="nofollow noreferrer">2</a>) that refer to Service Accounts</li>
</ul>

scubbo
<p>It appears you have used <code>| base64</code> instead of <code>| base64 --decode</code></p>
