Skip to content

Commit 887d2d8

Browse files
committed
Clean up access-cluster-services.md
1 parent 8f72515 commit 887d2d8

File tree

1 file changed

+62
-65
lines changed

1 file changed

+62
-65
lines changed

content/en/docs/tasks/access-application-cluster/access-cluster-services.md

Lines changed: 62 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,10 @@ weight: 140
77
<!-- overview -->
88
This page shows how to connect to services running on the Kubernetes cluster.
99

10-
1110
## {{% heading "prerequisites" %}}
1211

13-
1412
{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
1513

16-
1714
<!-- steps -->
1815

1916
## Accessing services running on the cluster
@@ -28,30 +25,30 @@ such as your desktop machine.
2825

2926
You have several options for connecting to nodes, pods and services from outside the cluster:
3027

31-
- Access services through public IPs.
32-
- Use a service with type `NodePort` or `LoadBalancer` to make the service reachable outside
33-
the cluster. See the [services](/docs/concepts/services-networking/service/) and
34-
[kubectl expose](/docs/reference/generated/kubectl/kubectl-commands/#expose) documentation.
35-
- Depending on your cluster environment, this may only expose the service to your corporate network,
36-
or it may expose it to the internet. Think about whether the service being exposed is secure.
37-
Does it do its own authentication?
38-
- Place pods behind services. To access one specific pod from a set of replicas, such as for debugging,
39-
place a unique label on the pod and create a new service which selects this label.
40-
- In most cases, it should not be necessary for application developer to directly access
41-
nodes via their nodeIPs.
42-
- Access services, nodes, or pods using the Proxy Verb.
43-
- Does apiserver authentication and authorization prior to accessing the remote service.
44-
Use this if the services are not secure enough to expose to the internet, or to gain
45-
access to ports on the node IP, or for debugging.
46-
- Proxies may cause problems for some web applications.
47-
- Only works for HTTP/HTTPS.
48-
- Described [here](#manually-constructing-apiserver-proxy-urls).
28+
- Access services through public IPs.
29+
- Use a service with type `NodePort` or `LoadBalancer` to make the service reachable outside
30+
the cluster. See the [services](/docs/concepts/services-networking/service/) and
31+
[kubectl expose](/docs/reference/generated/kubectl/kubectl-commands/#expose) documentation.
32+
- Depending on your cluster environment, this may only expose the service to your corporate network,
33+
or it may expose it to the internet. Think about whether the service being exposed is secure.
34+
Does it do its own authentication?
35+
- Place pods behind services. To access one specific pod from a set of replicas, such as for debugging,
36+
place a unique label on the pod and create a new service which selects this label.
37+
- In most cases, it should not be necessary for application developer to directly access
38+
nodes via their nodeIPs.
39+
- Access services, nodes, or pods using the Proxy Verb.
40+
- Does apiserver authentication and authorization prior to accessing the remote service.
41+
Use this if the services are not secure enough to expose to the internet, or to gain
42+
access to ports on the node IP, or for debugging.
43+
- Proxies may cause problems for some web applications.
44+
- Only works for HTTP/HTTPS.
45+
- Described [here](#manually-constructing-apiserver-proxy-urls).
4946
- Access from a node or pod in the cluster.
50-
- Run a pod, and then connect to a shell in it using [kubectl exec](/docs/reference/generated/kubectl/kubectl-commands/#exec).
51-
Connect to other nodes, pods, and services from that shell.
52-
- Some clusters may allow you to ssh to a node in the cluster. From there you may be able to
53-
access cluster services. This is a non-standard method, and will work on some clusters but
54-
not others. Browsers and other tools may or may not be installed. Cluster DNS may not work.
47+
- Run a pod, and then connect to a shell in it using [kubectl exec](/docs/reference/generated/kubectl/kubectl-commands/#exec).
48+
Connect to other nodes, pods, and services from that shell.
49+
- Some clusters may allow you to ssh to a node in the cluster. From there you may be able to
50+
access cluster services. This is a non-standard method, and will work on some clusters but
51+
not others. Browsers and other tools may or may not be installed. Cluster DNS may not work.
5552

5653
### Discovering builtin services
5754

@@ -75,19 +72,23 @@ heapster is running at https://192.0.2.1/api/v1/namespaces/kube-system/services/
7572

7673
This shows the proxy-verb URL for accessing each service.
7774
For example, this cluster has cluster-level logging enabled (using Elasticsearch), which can be reached
78-
at `https://192.0.2.1/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/` if suitable credentials are passed, or through a kubectl proxy at, for example:
75+
at `https://192.0.2.1/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/`
76+
if suitable credentials are passed, or through a kubectl proxy at, for example:
7977
`http://localhost:8080/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/`.
8078

8179
{{< note >}}
82-
See [Access Clusters Using the Kubernetes API](/docs/tasks/administer-cluster/access-cluster-api/#accessing-the-cluster-api) for how to pass credentials or use kubectl proxy.
80+
See [Access Clusters Using the Kubernetes API](/docs/tasks/administer-cluster/access-cluster-api/#accessing-the-cluster-api)
81+
for how to pass credentials or use kubectl proxy.
8382
{{< /note >}}
8483

8584
#### Manually constructing apiserver proxy URLs
8685

87-
As mentioned above, you use the `kubectl cluster-info` command to retrieve the service's proxy URL. To create proxy URLs that include service endpoints, suffixes, and parameters, you append to the service's proxy URL:
86+
As mentioned above, you use the `kubectl cluster-info` command to retrieve the service's proxy URL. To create
87+
proxy URLs that include service endpoints, suffixes, and parameters, you append to the service's proxy URL:
8888
`http://`*`kubernetes_master_address`*`/api/v1/namespaces/`*`namespace_name`*`/services/`*`[https:]service_name[:port_name]`*`/proxy`
8989

90-
If you haven't specified a name for your port, you don't have to specify *port_name* in the URL. You can also use the port number in place of the *port_name* for both named and unnamed ports.
90+
If you haven't specified a name for your port, you don't have to specify *port_name* in the URL. You can also
91+
use the port number in place of the *port_name* for both named and unnamed ports.
9192

9293
By default, the API server proxies to your service using HTTP. To use HTTPS, prefix the service name with `https:`:
9394
`http://<kubernetes_master_address>/api/v1/namespaces/<namespace_name>/services/<service_name>/proxy`
@@ -99,53 +100,49 @@ The supported formats for the `<service_name>` segment of the URL are:
99100
* `https:<service_name>:` - proxies to the default or unnamed port using https (note the trailing colon)
100101
* `https:<service_name>:<port_name>` - proxies to the specified port name or port number using https
101102

102-
103103
##### Examples
104104

105105
* To access the Elasticsearch service endpoint `_search?q=user:kimchy`, you would use:
106106

107-
```
108-
http://192.0.2.1/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/_search?q=user:kimchy
109-
```
107+
```
108+
http://192.0.2.1/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/_search?q=user:kimchy
109+
```
110110

111111
* To access the Elasticsearch cluster health information `_cluster/health?pretty=true`, you would use:
112112

113-
```
114-
https://192.0.2.1/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/_cluster/health?pretty=true
115-
```
116-
117-
The health information is similar to this:
118-
119-
```json
120-
{
121-
"cluster_name" : "kubernetes_logging",
122-
"status" : "yellow",
123-
"timed_out" : false,
124-
"number_of_nodes" : 1,
125-
"number_of_data_nodes" : 1,
126-
"active_primary_shards" : 5,
127-
"active_shards" : 5,
128-
"relocating_shards" : 0,
129-
"initializing_shards" : 0,
130-
"unassigned_shards" : 5
131-
}
132-
```
113+
```
114+
https://192.0.2.1/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/_cluster/health?pretty=true
115+
```
116+
117+
The health information is similar to this:
118+
119+
```json
120+
{
121+
"cluster_name" : "kubernetes_logging",
122+
"status" : "yellow",
123+
"timed_out" : false,
124+
"number_of_nodes" : 1,
125+
"number_of_data_nodes" : 1,
126+
"active_primary_shards" : 5,
127+
"active_shards" : 5,
128+
"relocating_shards" : 0,
129+
"initializing_shards" : 0,
130+
"unassigned_shards" : 5
131+
}
132+
```
133133

134134
* To access the *https* Elasticsearch service health information `_cluster/health?pretty=true`, you would use:
135135

136-
```
137-
https://192.0.2.1/api/v1/namespaces/kube-system/services/https:elasticsearch-logging:/proxy/_cluster/health?pretty=true
138-
```
136+
```
137+
https://192.0.2.1/api/v1/namespaces/kube-system/services/https:elasticsearch-logging:/proxy/_cluster/health?pretty=true
138+
```
139139

140140
#### Using web browsers to access services running on the cluster
141141

142142
You may be able to put an apiserver proxy URL into the address bar of a browser. However:
143143

144-
- Web browsers cannot usually pass tokens, so you may need to use basic (password) auth. Apiserver can be configured to accept basic auth,
145-
but your cluster may not be configured to accept basic auth.
146-
- Some web apps may not work, particularly those with client side javascript that construct URLs in a
147-
way that is unaware of the proxy path prefix.
148-
149-
150-
151-
144+
- Web browsers cannot usually pass tokens, so you may need to use basic (password) auth.
145+
Apiserver can be configured to accept basic auth,
146+
but your cluster may not be configured to accept basic auth.
147+
- Some web apps may not work, particularly those with client side javascript that construct URLs in a
148+
way that is unaware of the proxy path prefix.

0 commit comments

Comments
 (0)