I played around with a few approaches and this seems to be the simplest. You can use this to experiment with the api.
This sets up an ubuntu box with curl pre-installed. It also creates a service account with permissions to see pods and jobs. The auth token created by this service account is stored at /var/run/secrets/kubernetes.io/serviceaccount/token
apiVersion: v1
kind: ServiceAccount
metadata:
name: access-k8s-api