diff --git a/.github/get-kubeconfig.sh b/.github/get-kubeconfig.sh
deleted file mode 100755
index 5057b0e2f4..0000000000
--- a/.github/get-kubeconfig.sh
+++ /dev/null
@@ -1,167 +0,0 @@
-#!/bin/bash
-
-# Copyright 2020 Gravitational, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# original script was downloaded from
-# https://github.com/gravitational/teleport/blob/master/examples/k8s-auth/get-kubeconfig.sh
-
-# This script creates a new k8s Service Account and generates a kubeconfig with
-# its credentials. This Service Account has all the necessary permissions for
-# Teleport. The kubeconfig is written in the current directory.
-#
-# You can override the default namespace "teleport" using the
-# NAMESPACE_NAME environment variable.
-# You can override the default service account name "teleport-sa" using the
-# SA_NAME environment variable.
-
-set -eu -o pipefail
-
-# Allow passing in common name and username in environment. If not provided,
-# use default.
-SA=${SA_NAME:-kubectl}
-NAMESPACE=${NAMESPACE_NAME:-kube-system}
-
-# Set OS specific values.
-if [[ "$OSTYPE" == "linux-gnu" ]]; then
-    BASE64_DECODE_FLAG="-d"
-elif [[ "$OSTYPE" == "darwin"* ]]; then
-    BASE64_DECODE_FLAG="-D"
-elif [[ "$OSTYPE" == "linux-musl" ]]; then
-    BASE64_DECODE_FLAG="-d"
-else
-    echo "Unknown OS ${OSTYPE}"
-    exit 1
-fi
-
-echo "Creating the Kubernetes Service Account with minimal RBAC permissions."
-kubectl apply -f - <<EOF
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ${NAMESPACE}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: ${SA}
-  namespace: ${NAMESPACE}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: teleport-role
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - users
-  - groups
-  - serviceaccounts
-  verbs:
-  - impersonate
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - get
-- apiGroups:
-  - "authorization.k8s.io"
-  resources:
-  - selfsubjectaccessreviews
-  - selfsubjectrulesreviews
-  verbs:
-  - create
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: kubectl-test-crb
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-- kind: ServiceAccount
-  name: ${SA}
-  namespace: ${NAMESPACE}
-EOF
-
-# Checks if secret entry was defined for Service account. If defined it means that Kubernetes server has a
-# version below 1.24, otherwise one must manually create the secret and bind it to the Service account to have a non expiring token.
-# After Kubernetes v1.24 Service accounts no longer generate automatic tokens/secrets.
-# We can use kubectl create token but the token has a expiration time.
-# https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#urgent-upgrade-notes
-SA_SECRET_NAME=$(kubectl get -n ${NAMESPACE} sa/${SA} -o "jsonpath={.secrets[0]..name}")
-if [ -z $SA_SECRET_NAME ]
-then
-# Create the secret and bind it to the desired SA
-kubectl apply -f - <<EOF
-apiVersion: v1
-kind: Secret
-type: kubernetes.io/service-account-token
-metadata:
-  name: ${SA}
-  namespace: ${NAMESPACE}
-  annotations:
-    kubernetes.io/service-account.name: "${SA}"
-EOF
-
-SA_SECRET_NAME=${SA}
-fi
-
-# Note: service account token is stored base64-encoded in the secret but must
-# be plaintext in kubeconfig.
-SA_TOKEN=$(kubectl get -n ${NAMESPACE} secrets/${SA_SECRET_NAME} -o "jsonpath={.data['token']}" | base64 ${BASE64_DECODE_FLAG})
-CA_CERT=$(kubectl get -n ${NAMESPACE} secrets/${SA_SECRET_NAME} -o "jsonpath={.data['ca\.crt']}")
-
-# Extract cluster IP from the current context
-CURRENT_CONTEXT=$(kubectl config current-context)
-CURRENT_CLUSTER=$(kubectl config view -o jsonpath="{.contexts[?(@.name == \"${CURRENT_CONTEXT}\"})].context.cluster}")
-CURRENT_CLUSTER_ADDR=$(kubectl config view -o jsonpath="{.clusters[?(@.name == \"${CURRENT_CLUSTER}\"})].cluster.server}")
-
-echo "Writing kubeconfig."
-cat > kubeconfig <<EOF
-apiVersion: v1
-clusters:
-- cluster:
-    certificate-authority-data: ${CA_CERT}
-    server: ${CURRENT_CLUSTER_ADDR}
-  name: ${CURRENT_CLUSTER}
-contexts:
-- context:
-    cluster: ${CURRENT_CLUSTER}
-    user: ${CURRENT_CLUSTER}-${SA}
-  name: ${CURRENT_CONTEXT}
-current-context: ${CURRENT_CONTEXT}
-kind: Config
-preferences: {}
-users:
-- name: ${CURRENT_CLUSTER}-${SA}
-  user:
-    token: ${SA_TOKEN}
-EOF
-
-echo "---
-Done!
-
-Copy the generated kubeconfig file to your Teleport Proxy server, and set the
-kubeconfig_file parameter in your teleport.yaml config file to point to this
-kubeconfig file.
-
-If you need access to multiple kubernetes clusters, you can generate additional
-kubeconfig files using this script and then merge them using merge-kubeconfigs.sh.
-
-Note: Kubernetes RBAC rules for Teleport were created, you won't need to create them manually."
diff --git a/.github/tools/kubeconfig-merger/main.go b/.github/tools/kubeconfig-merger/main.go
deleted file mode 100644
index 3a6c6a8e60..0000000000
--- a/.github/tools/kubeconfig-merger/main.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Copyright Authors of Cilium
-
-package main
-
-import (
-	"flag"
-	"fmt"
-	"os"
-
-	"k8s.io/client-go/tools/clientcmd"
-	"k8s.io/client-go/tools/clientcmd/api"
-)
-
-func main() {
-	flags()
-
-	config1, err := clientcmd.LoadFromFile(flag.Arg(0))
-	if err != nil {
-		fmt.Println(err)
-		os.Exit(1)
-	}
-	config2, err := clientcmd.LoadFromFile(flag.Arg(1))
-	if err != nil {
-		fmt.Println(err)
-		os.Exit(1)
-	}
-
-	config := mergeKubeconfigs(config1, config2)
-
-	clientcmd.WriteToFile(*config, flag.Arg(2))
-}
-
-func flags() {
-	flag.Parse()
-	if flag.NArg() != 3 {
-		fmt.Println("Provide two kubeconfig files that need merging and target file")
-		os.Exit(1)
-	}
-}
-
-func mergeKubeconfigs(conf1, conf2 *api.Config) *api.Config {
-	for name, cluster := range conf2.Clusters {
-		conf1.Clusters[name] = cluster
-	}
-
-	userOverrides := map[string]string{}
-	for name, user := range conf2.AuthInfos {
-		if _, ok := conf1.AuthInfos[name]; ok {
-			userOverrides[name] = name + "-override"
-			name = userOverrides[name]
-		}
-		conf1.AuthInfos[name] = user
-	}
-
-	for name, context := range conf2.Contexts {
-		if _, ok := userOverrides[context.AuthInfo]; ok {
-			context.AuthInfo = userOverrides[context.AuthInfo]
-		}
-		conf1.Contexts[name] = context
-	}
-
-	return conf1
-}
diff --git a/CODEOWNERS b/CODEOWNERS
index 7ea8d1ccd0..55c573fbb6 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -15,7 +15,6 @@
 /RELEASE.md @cilium/cilium-cli-maintainers
 /.github/ @cilium/contributing
 /.github/gcp-vm-startup.sh @cilium/ci-structure
-/.github/get-kubeconfig.sh @cilium/github-sec @cilium/ci-structure
 /.github/kind-config*.yaml @cilium/ci-structure
 /.github/tools/ @cilium/ci-structure
 /.github/workflows/ @cilium/github-sec @cilium/ci-structure