ServiceAccount Tokens for API Access

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

Before you begin, make sure that:

A tenant already exists in Cozystack. See Create a User Tenant if you haven’t created one yet.
You have access to the tenant namespace — either via OIDC credentials or an administrative kubeconfig.
kubectl is installed and configured.
(Optional) jq is installed.

Retrieving the ServiceAccount Token

Each tenant in Cozystack has a Secret that contains a ServiceAccount token. The Secret has the same name as the tenant and is located in the tenant’s namespace.

How to generate kubeconfig for tenant users

Mon, 01 Jan 0001 00:00:00 +0000

To generate a kubeconfig for tenant users, use the following script. As a result, you’ll receive the tenant-kubeconfig file, which you can provide to the user.

SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
kubectl get secret tenant-root -n tenant-root -o go-template='
apiVersion: v1
kind: Config
clusters:
- name: tenant-root
 cluster:
 server: '"$SERVER"'
 certificate-authority-data: {{ index .data "ca.crt" }}
contexts:
- name: tenant-root
 context:
 cluster: tenant-root
 namespace: {{ index .data "namespace" | base64decode }}
 user: tenant-root
current-context: tenant-root
users:
- name: tenant-root
 user:
 token: {{ index .data "token" | base64decode }}
' \
> tenant-root.kubeconfig

Frequently asked questions and How-to guides on Cozystack

ServiceAccount Tokens for API Access

Prerequisites

Retrieving the ServiceAccount Token

How to generate kubeconfig for tenant users