Service account kubeconfig generator
Get a script that creates a service account with the right RBAC and writes a kubeconfig for it. The token never touches this page.
Runs locally. Nothing you paste leaves this tab.
How to use it
Save the script as create-sa.sh and run bash create-sa.sh with your normal admin access. It shows the cluster and asks before changing anything (set YES=1 to skip the question in automation). The token is created on your machine and written straight into the kubeconfig file: it never passes through this page.
bash create-sa.sh
KUBECONFIG=./ci-deployer.kubeconfig kubectl get podsShort-lived or long-lived token?
Since Kubernetes 1.24, service accounts no longer get a token Secret automatically, which is why many older guides stop working. kubectl create token issues a token that expires; the API server may cap how long it can be. For CI, create a new token in each run. A Secret of type kubernetes.io/service-account-token gives a token that never expires: only use it when nothing else works, and delete it when you are done.
Better options for CI on a managed cluster
On AKS, EKS and GKE, CI pipelines can sign in with workload identity or OIDC federation (for example GitHub Actions with azure/login and kubelogin), so there is no token to store or leak. Use a service account kubeconfig when that is not available.
Before you share the kubeconfig
The file contains a working credential. Send it through a secret store, not chat or email, and run it through the redactor before pasting it anywhere for troubleshooting.