kubectl create role pod-reader --verb=get --verb=list --verb=watch --resource=pods --dry-run=client -o yaml

kubectl create rolebinding pod-reader-binding \
  --clusterrole=pod-reader-role \
  --serviceaccount=demo:pod-reader \
  --dry-run=client -o yaml


kubectl create serviceaccount pod-reader --dry-run=client -o yaml

kubectl create token pod-reader

kubectl create token default --duration 10m



curl --cacert ca.crt -H "Authorization: Bearer $TOKEN" https://kubernetes.default/api/v1/namespaces/demo/pods