Answers: <p>When you set up a KubeApps deployment you must install a Kubernetes secret, <a href="https://kubeapps.dev/" rel="nofollow noreferrer">currently the installation instructions</a> detail it like this,</p>
  <pre class="lang-yaml prettyprint-override"><code>
  kubectl create clusterrolebinding kubeapps-operator --clusterrole=cluster-admin --serviceaccount=default:kubeapps-operator
  
  cat &lt;&lt;EOF | kubectl apply -f -
  apiVersion: v1
  kind: Secret
  metadata:
    name: kubeapps-operator-token
    namespace: default
    annotations:
      kubernetes.io/service-account.name: kubeapps-operator
  type: kubernetes.io/service-account-token
  EOF
  
  kubectl get --namespace default secret kubeapps-operator-token -o jsonpath='{.data.token}' -o go-template='{{.data.token | base64decode}}' &amp;&amp; echo
  </code></pre>
  <p>So basically it's a <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer">service-account-token</a> installed in the default namespace. You can list these like this,</p>
  <pre><code> kubectl get --namespace default secrets
  </code></pre>
  <p>You specifically want the <code>kubeapps-operator-token</code> and you can get it with the last line,</p>
  <pre><code>kubectl get --namespace default secret kubeapps-operator-token -o jsonpath='{.data.token}' -o go-template='{{.data.token | base64decode}}'
  </code></pre>
  <p>The <code> -o go-template='{{.data.token | base64decode}}'</code> is basically just piping it to <code>base64 -d</code> in Go (like this).</p>
  <pre><code>kubectl get --namespace default secret kubeapps-operator-token -o jsonpath='{.data.token}' | base64 -d
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2022-06-16T05:18:33.540Z
Answers: 2022-06-16T05:34:13.440Z
Answers: 2022-06-16T05:34:13.440Z
Answers: Evan Carroll
Body: <p>How can I retrieve the root token from a KubeApps deployment?</p>
  
Comments: CC BY-SA 4.0
Comments: 2022-06-16T15:29:56.137Z
Comments: What details or clarity is needed here, it's a self answered question?
Comments: Evan Carroll
Comments: CC BY-SA 4.0
Comments: 2022-06-20T03:43:17.773Z
Comments: Note this is self-answered.
Comments: Evan Carroll
Tags: <secret-management><authentication><kubeapps>
Title: How can I retrieve a lost login token for KubeApps?
UserDisplayName: Evan Carroll
ThreadText: # How can I retrieve a lost login token for KubeApps?
  
  (Asked by: username_0 on 2022-06-16)
  
  How can I retrieve the root token from a KubeApps deployment?
  
  **Tags:** secret-management, authentication, kubeapps
  
  > **Comments:**
  > **username_0**: What details or clarity is needed here, it's a self answered question?  
  > **username_0**: Note this is self-answered.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2022-06-16. Score: 0 | Accepted answer
  
  When you set up a KubeApps deployment you must install a Kubernetes secret, [currently the installation instructions](https://kubeapps.dev/) detail it like this,
  
  ```yaml
  
  kubectl create clusterrolebinding kubeapps-operator --clusterrole=cluster-admin --serviceaccount=default:kubeapps-operator
  
  cat <<EOF | kubectl apply -f -
  apiVersion: v1
  kind: Secret
  metadata:
    name: kubeapps-operator-token
    namespace: default
    annotations:
      kubernetes.io/service-account.name: kubeapps-operator
  type: kubernetes.io/service-account-token
  EOF
  
  kubectl get --namespace default secret kubeapps-operator-token -o jsonpath='{.data.token}' -o go-template='{{.data.token | base64decode}}' && echo
  
  ```
  
  So basically it's a [service-account-token](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) installed in the default namespace. You can list these like this,
  
  ```
   kubectl get --namespace default secrets
  
  ```
  
  You specifically want the `kubeapps-operator-token` and you can get it with the last line,
  
  ```
  kubectl get --namespace default secret kubeapps-operator-token -o jsonpath='{.data.token}' -o go-template='{{.data.token | base64decode}}'
  
  ```
  
  The  `-o go-template='{{.data.token | base64decode}}'` is basically just piping it to `base64 -d` in Go (like this).
  
  ```
  kubectl get --namespace default secret kubeapps-operator-token -o jsonpath='{.data.token}' | base64 -d
  
  ```
  
  
  ---
  
  