Date: 2026-02-02
Provide a scoped, read-only kubeconfig for operators on other hosts without sharing admin credentials.
sudo KUBECONFIG=/etc/kubernetes/admin.conf kubectl apply -f - <<'YAML'
apiVersion: v1
kind: ServiceAccount
metadata:
name: kubectl-readonly
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: kubectl-readonly-view
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: view
subjects:
- kind: ServiceAccount
name: kubectl-readonly
namespace: kube-system
YAML
sudo KUBECONFIG=/etc/kubernetes/admin.conf \
kubectl -n kube-system create token kubectl-readonly
/etc/kubernetes/pki/ca.crt.https://192.168.1.216:6443.