Which RBAC role is required to get service account token?

Issue

• We need a token for prometheus-k8s service account to access metrics data, but oc serviceaccounts get-token command run by a user with view ClusterRole fails with the following error.

  $ oc serviceaccounts get-token prometheus-k8s -n openshift-monitoring
  error: could not find a service account token for service account "prometheus-k8s"
  

• Which RBAC role is required to get service account token?