---
title: "Kubernetes API service account"
description: "Create the service account and bearer token Guardian uses to scan the Kubernetes API."
product: "Guardian"
edition: "Classic"
type: "workflow"
url: "https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/account-setup/kubernetes-api-service-account/"
---
# Kubernetes API service account

To add the Kubernetes API to your Guardian instance for Agentless scanning, you need a service account set up with the correct permissions that will enable you to add the node to Guardian for monitoring. The service account is then used to generate the bearer token that is used to verify Guardian's access to the API.

Applies to: `Guardian Classic`

!!! tip

    For more information on how to add the Kubernetes API node to Guardian, see [Kubernetes API Node](https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/add-a-single-node/agentless/kubernetes-api-node/index.md).

## Bearer token

The bearer token is required to add the Kubernetes API to Guardian, as it is used to collect and report information about your Kubernetes cluster. To generate the bearer token, use the following manifest file.

!!! note

    In the example below, the file has been saved as 'cluster-scan-manifest.yaml'.

```
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: guardian
  namespace: default
---
apiVersion: v1
kind: Secret
metadata:
  name: guardian-token
  namespace: default
  annotations:
    kubernetes.io/service-account.name: guardian
type: kubernetes.io/service-account-token
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: guardian-cluster-view-all
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
- nonResourceURLs:
  - '*'
  verbs:
  - get
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: guardian-cluster-view
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: guardian-cluster-view-all
subjects:
- kind: ServiceAccount
  name: guardian
  namespace: default
```

To apply the above manifest to your cluster, run the following command.

```
kubectl apply -f cluster-scan-manifest.yaml
```