# Kubernetes Service Account Token

## Summary

**Kubernetes Service Account Token** authenticates requests to a Kubernetes API server.

Pomerium will [impersonate](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation) the Pomerium user's identity, and Kubernetes RBAC can be applied to identity provider users and groups.

## How to configure

**Core:**

| **Config file key** | **Type** | **Usage** |
| :-- | :-- | :-- |
| `kubernetes_service_account_token` | `string` | **optional** |
| `kubernetes_service_account_token_file` | `bearer token` file path | **optional** |

### Examples

```yaml
kubernetes_service_account_token: eyJ0eXAiOiJKV1QiLCJhbGciOiJ...

kubernetes_service_account_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
```

**Enterprise:**

**Kubernetes:**

This option is not supported in Kubernetes.