diff --git a/forgejoRunner/README.md b/forgejoRunner/README.md
index de65e77..13b5160 100644
--- a/forgejoRunner/README.md
+++ b/forgejoRunner/README.md
@@ -12,6 +12,41 @@ kubectl create secret generic forgejo-runner \
     -n <namespace>
 ```
 
+## Builder
+
+To use the Buildx builder in your Forgejo action a kubeconfig is required.
+
+```bash
+name=buildx-sa-token
+server=$(kubectl config view --minify --output 'jsonpath={.clusters[0].cluster.server}')
+ca=$(kubectl get secret/$name -o jsonpath='{.data.ca\.crt}')
+token=$(kubectl get secret/$name -o jsonpath='{.data.token}' | base64 --decode)
+namespace=$(kubectl get secret/$name -o jsonpath='{.data.namespace}' | base64 --decode)
+
+echo "
+apiVersion: v1
+kind: Config
+clusters:
+- name: default-cluster
+  cluster:
+    certificate-authority-data: ${ca}
+    server: ${server}
+contexts:
+- name: default-context
+  context:
+    cluster: default-cluster
+    namespace: default
+    user: default-user
+current-context: default-context
+users:
+- name: default-user
+  user:
+    token: ${token}
+" > buildx.kubeconfig
+```
+
+Setup secret `KUBECONFIG_BUILDX` with content of `buildx.kubeconfig`.
+
 ## Parameters
 
 ### Forgejo Runner parameters
diff --git a/forgejoRunner/templates/rbac.yaml b/forgejoRunner/templates/rbac.yaml
new file mode 100644
index 0000000..2a88ae5
--- /dev/null
+++ b/forgejoRunner/templates/rbac.yaml
@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: buildx
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations:
+    kubernetes.io/service-account.name: buildx
+  name: buildx-sa-token
+type: kubernetes.io/service-account-token
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: admin
+subjects:
+- kind: ServiceAccount
+  name: buildx