Skip to content

Commit 7639bfb

Browse files
uhari03uhari03
authored
Move accessing API from within pod to tasks (#26601)
* Move accessing API from within pod to tasks * Remove reviewers, version check; Add whatsnext * Move to run applications * Fix what's next section link
1 parent 1b491be commit 7639bfb

File tree

2 files changed

+113
-98
lines changed

2 files changed

+113
-98
lines changed

‎content/en/docs/tasks/administer-cluster/access-cluster-api.md

Lines changed: 2 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -352,102 +352,6 @@ exampleWithKubeConfig = do
352352
>>= print
353353
```
354354

355+
## {{% heading "whatsnext" %}}
355356

356-
### Accessing the API from within a Pod
357-
358-
When accessing the API from within a Pod, locating and authenticating
359-
to the API server are slightly different to the external client case described above.
360-
361-
The easiest way to use the Kubernetes API from a Pod is to use
362-
one of the official [client libraries](/docs/reference/using-api/client-libraries/). These
363-
libraries can automatically discover the API server and authenticate.
364-
365-
#### Using Official Client Libraries
366-
367-
From within a Pod, the recommended ways to connect to the Kubernetes API are:
368-
369-
- For a Go client, use the official [Go client library](https://github.com/kubernetes/client-go/).
370-
The `rest.InClusterConfig()` function handles API host discovery and authentication automatically.
371-
See [an example here](https://git.k8s.io/client-go/examples/in-cluster-client-configuration/main.go).
372-
373-
- For a Python client, use the official [Python client library](https://github.com/kubernetes-client/python/).
374-
The `config.load_incluster_config()` function handles API host discovery and authentication automatically.
375-
See [an example here](https://github.com/kubernetes-client/python/blob/master/examples/in_cluster_config.py).
376-
377-
- There are a number of other libraries available, please refer to the [Client Libraries](/docs/reference/using-api/client-libraries/) page.
378-
379-
In each case, the service account credentials of the Pod are used to communicate
380-
securely with the API server.
381-
382-
#### Directly accessing the REST API
383-
384-
While running in a Pod, the Kubernetes apiserver is accessible via a Service named
385-
`kubernetes` in the `default` namespace. Therefore, Pods can use the
386-
`kubernetes.default.svc` hostname to query the API server. Official client libraries
387-
do this automatically.
388-
389-
The recommended way to authenticate to the API server is with a
390-
[service account](/docs/tasks/configure-pod-container/configure-service-account/) credential. By default, a Pod
391-
is associated with a service account, and a credential (token) for that
392-
service account is placed into the filesystem tree of each container in that Pod,
393-
at `/var/run/secrets/kubernetes.io/serviceaccount/token`.
394-
395-
If available, a certificate bundle is placed into the filesystem tree of each
396-
container at `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`, and should be
397-
used to verify the serving certificate of the API server.
398-
399-
Finally, the default namespace to be used for namespaced API operations is placed in a file
400-
at `/var/run/secrets/kubernetes.io/serviceaccount/namespace` in each container.
401-
402-
#### Using kubectl proxy
403-
404-
If you would like to query the API without an official client library, you can run `kubectl proxy`
405-
as the [command](/docs/tasks/inject-data-application/define-command-argument-container/)
406-
of a new sidecar container in the Pod. This way, `kubectl proxy` will authenticate
407-
to the API and expose it on the `localhost` interface of the Pod, so that other containers
408-
in the Pod can use it directly.
409-
410-
#### Without using a proxy
411-
412-
It is possible to avoid using the kubectl proxy by passing the authentication token
413-
directly to the API server. The internal certificate secures the connection.
414-
415-
```shell
416-
# Point to the internal API server hostname
417-
APISERVER=https://kubernetes.default.svc
418-
419-
# Path to ServiceAccount token
420-
SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount
421-
422-
# Read this Pod's namespace
423-
NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace)
424-
425-
# Read the ServiceAccount bearer token
426-
TOKEN=$(cat ${SERVICEACCOUNT}/token)
427-
428-
# Reference the internal certificate authority (CA)
429-
CACERT=${SERVICEACCOUNT}/ca.crt
430-
431-
# Explore the API with TOKEN
432-
curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api
433-
```
434-
435-
The output will be similar to this:
436-
437-
```json
438-
{
439-
"kind": "APIVersions",
440-
"versions": [
441-
"v1"
442-
],
443-
"serverAddressByClientCIDRs": [
444-
{
445-
"clientCIDR": "0.0.0.0/0",
446-
"serverAddress": "10.0.1.149:443"
447-
}
448-
]
449-
}
450-
```
451-
452-
453-
357+
* [Accessing the Kubernetes API from a Pod](/docs/tasks/run-application/access-api-from-pod/)

‎content/en/docs/tasks/run-application/access-api-from-pod.md

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
---
2+
title: Accessing the Kubernetes API from a Pod
3+
content_type: task
4+
weight: 120
5+
---
6+
7+
<!-- overview -->
8+
9+
This guide demonstrates how to access the Kubernetes API from within a pod.
10+
11+
## {{% heading "prerequisites" %}}
12+
13+
{{< include "task-tutorial-prereqs.md" >}}
14+
15+
<!-- steps -->
16+
17+
## Accessing the API from within a Pod
18+
19+
When accessing the API from within a Pod, locating and authenticating
20+
to the API server are slightly different to the external client case.
21+
22+
The easiest way to use the Kubernetes API from a Pod is to use
23+
one of the official [client libraries](/docs/reference/using-api/client-libraries/). These
24+
libraries can automatically discover the API server and authenticate.
25+
26+
### Using Official Client Libraries
27+
28+
From within a Pod, the recommended ways to connect to the Kubernetes API are:
29+
30+
- For a Go client, use the official [Go client library](https://github.com/kubernetes/client-go/).
31+
The `rest.InClusterConfig()` function handles API host discovery and authentication automatically.
32+
See [an example here](https://git.k8s.io/client-go/examples/in-cluster-client-configuration/main.go).
33+
34+
- For a Python client, use the official [Python client library](https://github.com/kubernetes-client/python/).
35+
The `config.load_incluster_config()` function handles API host discovery and authentication automatically.
36+
See [an example here](https://github.com/kubernetes-client/python/blob/master/examples/in_cluster_config.py).
37+
38+
- There are a number of other libraries available, please refer to the [Client Libraries](/docs/reference/using-api/client-libraries/) page.
39+
40+
In each case, the service account credentials of the Pod are used to communicate
41+
securely with the API server.
42+
43+
### Directly accessing the REST API
44+
45+
While running in a Pod, the Kubernetes apiserver is accessible via a Service named
46+
`kubernetes` in the `default` namespace. Therefore, Pods can use the
47+
`kubernetes.default.svc` hostname to query the API server. Official client libraries
48+
do this automatically.
49+
50+
The recommended way to authenticate to the API server is with a
51+
[service account](/docs/tasks/configure-pod-container/configure-service-account/) credential. By default, a Pod
52+
is associated with a service account, and a credential (token) for that
53+
service account is placed into the filesystem tree of each container in that Pod,
54+
at `/var/run/secrets/kubernetes.io/serviceaccount/token`.
55+
56+
If available, a certificate bundle is placed into the filesystem tree of each
57+
container at `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`, and should be
58+
used to verify the serving certificate of the API server.
59+
60+
Finally, the default namespace to be used for namespaced API operations is placed in a file
61+
at `/var/run/secrets/kubernetes.io/serviceaccount/namespace` in each container.
62+
63+
### Using kubectl proxy
64+
65+
If you would like to query the API without an official client library, you can run `kubectl proxy`
66+
as the [command](/docs/tasks/inject-data-application/define-command-argument-container/)
67+
of a new sidecar container in the Pod. This way, `kubectl proxy` will authenticate
68+
to the API and expose it on the `localhost` interface of the Pod, so that other containers
69+
in the Pod can use it directly.
70+
71+
### Without using a proxy
72+
73+
It is possible to avoid using the kubectl proxy by passing the authentication token
74+
directly to the API server. The internal certificate secures the connection.
75+
76+
```shell
77+
# Point to the internal API server hostname
78+
APISERVER=https://kubernetes.default.svc
79+
80+
# Path to ServiceAccount token
81+
SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount
82+
83+
# Read this Pod's namespace
84+
NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace)
85+
86+
# Read the ServiceAccount bearer token
87+
TOKEN=$(cat ${SERVICEACCOUNT}/token)
88+
89+
# Reference the internal certificate authority (CA)
90+
CACERT=${SERVICEACCOUNT}/ca.crt
91+
92+
# Explore the API with TOKEN
93+
curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api
94+
```
95+
96+
The output will be similar to this:
97+
98+
```json
99+
{
100+
"kind": "APIVersions",
101+
"versions": [
102+
"v1"
103+
],
104+
"serverAddressByClientCIDRs": [
105+
{
106+
"clientCIDR": "0.0.0.0/0",
107+
"serverAddress": "10.0.1.149:443"
108+
}
109+
]
110+
}
111+
```

0 commit comments

Comments
 (0)