# Service Account

Lets create a service account for ci/cd activities in a new namespace.

## Namespace

```yaml
cat <<EOF | kubectl apply -f -
---
apiVersion: "v1"
kind: "Namespace"
metadata:
  name: "my-namespace"
EOF
```

## ServiceAccount

```yaml
cat <<EOF | kubectl apply -f -
---
apiVersion: "v1"
kind: "ServiceAccount"
metadata:
  name: "buzz"
  namespace: "my-namespace"
EOF
```

## Role

```yaml
cat <<EOF | kubectl apply -f -
---
apiVersion: "rbac.authorization.k8s.io/v1"
kind: "Role"
metadata:
  namespace: "my-namespace"
  name: "buzz-role"
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
  resources: ["services", "configmaps", "secrets"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
EOF
```

## RoleBinding

```yaml
cat <<EOF | kubectl apply -f -
---
apiVersion: "rbac.authorization.k8s.io/v1"
kind: "RoleBinding"
metadata:
  name: "buzz-binding"
  namespace: "my-namespace"
subjects:
- kind: "ServiceAccount"
  name: "buzz"
  namespace: "my-namespace"
roleRef:
  kind: "Role"
  name: "buzz-role"
  apiGroup: "rbac.authorization.k8s.io"
EOF
```

## Token and KubeConfig (OmnI)

Get the token for the user.

```shell
kubectl create token buzz -n my-namespace
```

When using OmnI you can get the service account details (kubeconfig) using the following command;

```shell
omnictl kubeconfig --service-account -c <cluster-name> --user buzz /tmp/buzz-kubeconfig.yaml
```