This message was deleted.

Not like that, no. You can generate additional user cert+key pairs if you have access to the cluster CA cert+key, but agents don’t have that - and SHOULD NOT have that data. Anyone who has access to the cluster CA keys essentially has full admin access to your cluster.

Is there a way agent can get the kubeconfig to access kubectl commands without manually copying it from the cluster?

If you could do that, you’d have a pretty handy way to attack exposed clusters, wouldn’t you?

I mean if there is any way of creating a service account with appropriate permissions and generating a kubeconfig file for that service account. Or if we have same certs and we generate kubeconfig with that cert.

You could use the built-in CertificateSigningRequest process to get the cluster to issue a cert for you… but you’d still need admin access to begin with in order to do that. https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/