kcp sa

kset .kcp/admin.kubeconfig

k ws tree

k create-workspace --enter one

k create-workspace --enter two

k create sa sa-in-two

token="$(k create token sa-in-two)"

kcp_url="$(k config view --minify -o jsonpath='{.clusters[0].cluster.server}')"

k get configmaps kube-root-ca.crt -o jsonpath='{.data.ca\.crt}' > ca.crt

k --kubeconfig sa.kubeconfig config set-cluster sa-cluster --server="$kcp_url" --certificate-authority=ca.crt --embed-certs=true
k --kubeconfig sa.kubeconfig config set-credentials sa-user --token="$token"

k --kubeconfig sa.kubeconfig config set-context sa-context --cluster=sa-cluster --user=sa-user

k --kubeconfig sa.kubeconfig config use-context sa-context

KUBECONFIG=sa.kubeconfig k ws tree

KUBECONFIG=sa.kubeconfig k ws :root

KUBECONFIG=sa.kubeconfig k ws tree

KUBECONFIG=sa.kubeconfig k ws :root:one