title: kubectl --token=$TOKEN doesn't run with the permissions of the token
body: <p>When I am using the command <code>kubectl</code> with the <code>--token</code> flag and specify a token, it still uses the administrator credentials from the <code>kubeconfig</code> file.</p>
  <p>This is what I did:</p>
  <pre><code>NAMESPACE=&quot;default&quot;
  SERVICE_ACCOUNT_NAME=&quot;sa1&quot;
  kubectl create sa $SERVICE_ACCOUNT_NAME
  kubectl create clusterrolebinding list-pod-clusterrolebinding \
       --clusterrole=list-pod-clusterrole \
       --serviceaccount=&quot;$NAMESPACE&quot;:&quot;$SERVICE_ACCOUNT_NAME&quot;
  kubectl create clusterrole list-pod-clusterrole \
       --verb=list \
       --resource=pods
  
  TOKEN=`kubectl get secrets $(kubectl get sa $SERVICE_ACCOUNT_NAME -o json | jq -r '.secrets[].name') -o json | jq -r '.data.token' | base64 -d`
  
  # Expected it will fail but it doesn't because it uses the admin credentials
  kubectl get secrets --token $TOKEN
  
  </code></pre>
  <p>The token have permissions to list pods, so I expect the <code>kubectl get secrets --token $TOKEN</code> to fail but it doesn't because it still uses the context of the administrator.</p>
  <p>I don't create new context, I know <code>kubectl</code> have this ability to use bearer token and want to understand how to do it.</p>
  <p>I also tried this <code>kubectl get secrets --insecure-skip-tls-verify --server https://&lt;master_ip&gt;:6443 --token $TOKEN</code>and it also didn't return a <code>Forbidden</code> result.</p>
  <p>If you test it you can use katacoda:<br />
  <a href="https://www.katacoda.com/courses/kubernetes/playground" rel="nofollow noreferrer">https://www.katacoda.com/courses/kubernetes/playground</a></p>
  <p><strong>EDIT:</strong></p>
  <p>I tried to create context with this:</p>
  <pre><code>NAMESPACE=&quot;default&quot;
  SERVICE_ACCOUNT_NAME=&quot;sa1&quot;
  CONTEXT_NAME=&quot;sa1-context&quot;
  USER_NAME=&quot;sa1-username&quot;
  CLUSTER_NAME=&quot;kubernetes&quot;
  
  kubectl create sa &quot;$SERVICE_ACCOUNT_NAME&quot; -n &quot;$NAMESPACE&quot;
  SECRET_NAME=`kubectl get serviceaccounts $SERVICE_ACCOUNT_NAME -n $NAMESPACE -o json | jq -r '.secrets[].name'`
  TOKEN=`kubectl get secrets $SECRET_NAME -n $NAMESPACE -o json | jq -r '.data | .token' | base64 -d`
  
  # Create user with the JWT token of the service account
  echo &quot;[*] Setting credentials for user: $USER_NAME&quot;
  kubectl config set-credentials $USER_NAME --token=$TOKEN
  
  # Makue sure the cluster name is correct !!!
  echo &quot;[*] Setting context: $CONTEXT_NAME&quot;
  kubectl config set-context $CONTEXT_NAME \
  --cluster=$CLUSTER_NAME \
  --namespace=$NAMESPACE \
  --user=$USER_NAME
  </code></pre>
  <p>But when I tried <code>kubectl get secrets --context $CONTEXT_NAME</code> it still succeeded and was supposed fail because it doesn't have permissions for that.</p>
  <p><strong>Edit 2:</strong><br />
  Option to run it correctly based on the <a href="https://kubernetes.io/docs/reference/kubectl/kubectl/" rel="nofollow noreferrer">kubectl API</a>:</p>
  <pre><code>kubectl get pods --token `cat /home/natan/token` -s https://&lt;ip&gt;:8443 --certificate-authority /root/.minikube/ca.crt --all-namespaces
  </code></pre>
  <p>Or without TLS:</p>
  <pre><code>kubectl get pods --token `cat /home/natan/token` -s https://&lt;ip&gt;:8443 --insecure-skip-tls-verify --all-namespaces
  </code></pre>