example-kubeconfig

apiVersion: v1
kind: Config
clusters:
- cluster:
    server: https://proxy.upbound.io/env/<env-id>
  name: uimeta
contexts:
- context:
    cluster: uimeta
    user: acme-corp
  name: uimeta
current-context: uimeta
preferences: {}
users:
- name: acme-corp
  user:
    token: <long-token>

Then the users will just need to run the following command in their app cluster:

kubectl create secret generic sa-secret --from-file=kubeconfig=example-kubeconfig
# Install the agent
helm install crossplane/agent --set credentials-secret-name=sa-secret

cc @prasek @mattheilman @lukeweber