Create namespace and service account
oc new-project ci
oc -n ci create sa ci-bot
Grant permissions (example: edit in namespace)
oc -n ci policy add-role-to-user edit system:serviceaccount:ci:ci-bot
Without permissions, token auth succeeds but API actions are denied.
Generate token (TokenRequest)
TOKEN=$(oc -n ci create token ci-bot)
Create kubeconfig using the token
oc config set-cluster lab --server="$(oc whoami --show-server)" \
--insecure-skip-tls-verify=true --kubeconfig=ci-bot.kubeconfig
oc config set-credentials ci-bot --token="$TOKEN" --kubeconfig=ci-bot.kubeconfig
oc config set-context ci --cluster=lab --user=ci-bot --namespace=ci \
--kubeconfig=ci-bot.kubeconfig
oc config use-context ci --kubeconfig=ci-bot.kubeconfig
Test access
oc --kubeconfig=ci-bot.kubeconfig get pods