• Home
  • About
  • Contact
  • Privacy
  • Terms
  • DCMA
  • Write For Us / Submit
Tech News, Magazine & Review WordPress Theme 2017
  • Tech
    How Drones and 360-Degree Cameras Are Changing Bridal Photoshoots

    How Drones and 360-Degree Cameras Are Changing Bridal Photoshoots

    120+ Best Creative Names for Team at Work

    120+ Best Creative Names for Team at Work

    Can You Repair Printed Circuit Board ?

    Mastering PCB Board Repair Comprehensive Guide

    Breaking Barriers Federal Inmate Texting Service

    Breaking Barriers Federal Inmate Texting Service

    transfer whatsapp from android to iphone

    How to Transfer WhatsApp from Android to iPhone!

    Understanding the Role of Humidity Chambers in Climate Testing

    Understanding the Role of Humidity Chambers in Climate Testing

    Everything You Get to Know About Movember Beard Memes

    Everything You Get to Know About Movember Beard Memes

    Best Book Recommendation Apps

    11 Best Book Recommendation Apps

    How to quickly divide or Split PDF files

    How to Quickly Divide or Split PDF Files

  • Gear
    • All
    • Camera
    • Laptop
    • Smartphone
    The New Galaxy Watch Ultra and Galaxy Ring Are Announced by Samsung

    The New Galaxy Watch Ultra and Galaxy Ring Are Announced by Samsung

    Exploring the Innovative Features of Pear Phones

    Exploring the Innovative Features of Pear Phones

    Latest Smart Home Gadgets for a Connected Life

    Latest Smart Home Gadgets for a Connected Life

    Eco-Friendly Products for Students

    Eco-Friendly Products for Students

    Essential Photography Equipment and Gadgets

    Mastering Your Shots: Essential Photography Equipment and Gadgets

    Level Up Your Game: Must-Have Gaming Gear!

    Level Up Your Game: Must-Have Gaming Gear!

    Trending Tags

    • Best iPhone 7 deals
    • Apple Watch 2
    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • iOS 10
    • iPhone 7
    • Sillicon Valley
  • Gaming
    Master the World of Online Gaming with the Best Gaming VPN

    Master the World of Online Gaming with 3 Best Gaming VPN

    7 Powerful Strategies to Overcome Video Game Addiction and Reclaim Your Life

    7 Powerful Strategies to Overcome Video Game Addiction and Reclaim Your Life

    Powerful Ways Xbox Cloud Gaming is Revolutionizing the Gaming World

    5 Powerful Ways Xbox Cloud Gaming is Revolutionizing the Gaming World

    9 Best Alternative Games Like Kahoot

    9 Best Alternative Games Like Kahoot

    The Top 8 Free Bubble Shooter Games for Endless Entertainment

    The Top 8 Free Bubble Shooter Games for Endless Entertainment

    Cloud Gaming Revolution: How Streaming is Changing the Future of Gaming

    Cloud Gaming Revolution: How Streaming is Changing the Future of Gaming

  • Crypto
    How Drones and 360-Degree Cameras Are Changing Bridal Photoshoots

    How Drones and 360-Degree Cameras Are Changing Bridal Photoshoots

    120+ Best Creative Names for Team at Work

    120+ Best Creative Names for Team at Work

    Can You Repair Printed Circuit Board ?

    Mastering PCB Board Repair Comprehensive Guide

    Breaking Barriers Federal Inmate Texting Service

    Breaking Barriers Federal Inmate Texting Service

    transfer whatsapp from android to iphone

    How to Transfer WhatsApp from Android to iPhone!

    Understanding the Role of Humidity Chambers in Climate Testing

    Understanding the Role of Humidity Chambers in Climate Testing

    Everything You Get to Know About Movember Beard Memes

    Everything You Get to Know About Movember Beard Memes

    Best Book Recommendation Apps

    11 Best Book Recommendation Apps

    How to quickly divide or Split PDF files

    How to Quickly Divide or Split PDF Files

  • Business
    How Drones and 360-Degree Cameras Are Changing Bridal Photoshoots

    How Drones and 360-Degree Cameras Are Changing Bridal Photoshoots

    120+ Best Creative Names for Team at Work

    120+ Best Creative Names for Team at Work

    Can You Repair Printed Circuit Board ?

    Mastering PCB Board Repair Comprehensive Guide

    Breaking Barriers Federal Inmate Texting Service

    Breaking Barriers Federal Inmate Texting Service

    transfer whatsapp from android to iphone

    How to Transfer WhatsApp from Android to iPhone!

    Understanding the Role of Humidity Chambers in Climate Testing

    Understanding the Role of Humidity Chambers in Climate Testing

    Everything You Get to Know About Movember Beard Memes

    Everything You Get to Know About Movember Beard Memes

    Best Book Recommendation Apps

    11 Best Book Recommendation Apps

    How to quickly divide or Split PDF files

    How to Quickly Divide or Split PDF Files

No Result
View All Result
Geeky Insider
  • Tech
    How Drones and 360-Degree Cameras Are Changing Bridal Photoshoots

    How Drones and 360-Degree Cameras Are Changing Bridal Photoshoots

    120+ Best Creative Names for Team at Work

    120+ Best Creative Names for Team at Work

    Can You Repair Printed Circuit Board ?

    Mastering PCB Board Repair Comprehensive Guide

    Breaking Barriers Federal Inmate Texting Service

    Breaking Barriers Federal Inmate Texting Service

    transfer whatsapp from android to iphone

    How to Transfer WhatsApp from Android to iPhone!

    Understanding the Role of Humidity Chambers in Climate Testing

    Understanding the Role of Humidity Chambers in Climate Testing

    Everything You Get to Know About Movember Beard Memes

    Everything You Get to Know About Movember Beard Memes

    Best Book Recommendation Apps

    11 Best Book Recommendation Apps

    How to quickly divide or Split PDF files

    How to Quickly Divide or Split PDF Files

  • Gear
    • All
    • Camera
    • Laptop
    • Smartphone
    The New Galaxy Watch Ultra and Galaxy Ring Are Announced by Samsung

    The New Galaxy Watch Ultra and Galaxy Ring Are Announced by Samsung

    Exploring the Innovative Features of Pear Phones

    Exploring the Innovative Features of Pear Phones

    Latest Smart Home Gadgets for a Connected Life

    Latest Smart Home Gadgets for a Connected Life

    Eco-Friendly Products for Students

    Eco-Friendly Products for Students

    Essential Photography Equipment and Gadgets

    Mastering Your Shots: Essential Photography Equipment and Gadgets

    Level Up Your Game: Must-Have Gaming Gear!

    Level Up Your Game: Must-Have Gaming Gear!

    Trending Tags

    • Best iPhone 7 deals
    • Apple Watch 2
    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • iOS 10
    • iPhone 7
    • Sillicon Valley
  • Gaming
    Master the World of Online Gaming with the Best Gaming VPN

    Master the World of Online Gaming with 3 Best Gaming VPN

    7 Powerful Strategies to Overcome Video Game Addiction and Reclaim Your Life

    7 Powerful Strategies to Overcome Video Game Addiction and Reclaim Your Life

    Powerful Ways Xbox Cloud Gaming is Revolutionizing the Gaming World

    5 Powerful Ways Xbox Cloud Gaming is Revolutionizing the Gaming World

    9 Best Alternative Games Like Kahoot

    9 Best Alternative Games Like Kahoot

    The Top 8 Free Bubble Shooter Games for Endless Entertainment

    The Top 8 Free Bubble Shooter Games for Endless Entertainment

    Cloud Gaming Revolution: How Streaming is Changing the Future of Gaming

    Cloud Gaming Revolution: How Streaming is Changing the Future of Gaming

  • Crypto
    How Drones and 360-Degree Cameras Are Changing Bridal Photoshoots

    How Drones and 360-Degree Cameras Are Changing Bridal Photoshoots

    120+ Best Creative Names for Team at Work

    120+ Best Creative Names for Team at Work

    Can You Repair Printed Circuit Board ?

    Mastering PCB Board Repair Comprehensive Guide

    Breaking Barriers Federal Inmate Texting Service

    Breaking Barriers Federal Inmate Texting Service

    transfer whatsapp from android to iphone

    How to Transfer WhatsApp from Android to iPhone!

    Understanding the Role of Humidity Chambers in Climate Testing

    Understanding the Role of Humidity Chambers in Climate Testing

    Everything You Get to Know About Movember Beard Memes

    Everything You Get to Know About Movember Beard Memes

    Best Book Recommendation Apps

    11 Best Book Recommendation Apps

    How to quickly divide or Split PDF files

    How to Quickly Divide or Split PDF Files

  • Business
    How Drones and 360-Degree Cameras Are Changing Bridal Photoshoots

    How Drones and 360-Degree Cameras Are Changing Bridal Photoshoots

    120+ Best Creative Names for Team at Work

    120+ Best Creative Names for Team at Work

    Can You Repair Printed Circuit Board ?

    Mastering PCB Board Repair Comprehensive Guide

    Breaking Barriers Federal Inmate Texting Service

    Breaking Barriers Federal Inmate Texting Service

    transfer whatsapp from android to iphone

    How to Transfer WhatsApp from Android to iPhone!

    Understanding the Role of Humidity Chambers in Climate Testing

    Understanding the Role of Humidity Chambers in Climate Testing

    Everything You Get to Know About Movember Beard Memes

    Everything You Get to Know About Movember Beard Memes

    Best Book Recommendation Apps

    11 Best Book Recommendation Apps

    How to quickly divide or Split PDF files

    How to Quickly Divide or Split PDF Files

Submit
Geeky Insider
No Result
View All Result

How to Access Your Kubernetes Cluster’s API From Within Your Pods

by Staff Writer
September 30, 2022
in How To
Reading Time: 7 mins read
Kubernetes logo
Share on FacebookShare on Twitter

The Kubernetes API is your route to inspecting and managing your cluster’s operations. You can consume the API using the Kubectl CLI, tools such as curl, or the official integration libraries for popular programming languages.

The API is available to applications within your cluster too. Kubernetes Pods are automatically given access to the API and can authenticate using a provided service account. You perform interactions by consuming the injected environment variables and certificate files to make connections from the client of your choice.

Table of Contents

Toggle
    • READ ALSO
    • How to Activate Iphone With Sim Card
    • How to Quickly Divide or Split PDF Files
  • Why Access The Kubernetes API Within Pods?
  • Using the API Client Libraries
  • Performing Manual API Interactions
  • Handling RBAC
  • Choosing a Different Service Account
  • Opting Out of Service Account Mounting
  • Summary

READ ALSO

transfer whatsapp from android to iphone

How to Transfer WhatsApp from Android to iPhone!

October 6, 2023
How to prevent phishing attacks

How to Prevent Phishing Attacks: Safeguarding Your Digital Identity

May 14, 2023

Why Access The Kubernetes API Within Pods?

There are several use cases for in-Pod API access. This technique allows applications to dynamically inspect their environment, apply Kubernetes changes, and collect control plane metrics that provide performance insights.

Some organizations develop their own tooling around Kubernetes. They might deploy a special in-cluster application that uses the API to expose additional functionality. Operating from within the cluster can be safer than making API calls from an external script as you don’t need to open up your environment or share service accounts and authentication tokens.

Using the API Client Libraries

The easiest and recommended method for accessing the Kubernetes API from a Pod is to use a client library. Fully supported options are available for C, .NET, Go, Haskell, Java, JavaScript, Perl, Python, and Ruby. There are equivalent community-maintained solutions for most other popular programming languages.

The client libraries have built-in support for discovering the cluster environment they’re running in. Each implementation provides a function you can call that will configure the library to connect to the correct API server.

Here’s an example of how to list the Pods in your cluster within a Python application:

from kubernetes import client, config
 
config.load_incluster_config()
 
api = client.CoreV1Api()
 
# Perform necessary API interactions
# pods = api.list_pod_for_all_namespaces()

This approach is easy to work with and requires no manual configuration. Sometimes you won’t be able to use a client library though. In those cases, it’s still possible to manually access the API using the service account Kubernetes provides.

Performing Manual API Interactions

To call the API you need to know two things: the in-cluster hostname it’s exposed on, and the service account token that will authenticate your Pod.

The API hostname is always kubernetes.default.svc. The Kubernetes DNS provider will resolve this name to the control plane’s API server. Alternatively, you can use the $KUBERNETES_SERVICE_HOST environment variable to discover the API server’s IP address:

$ echo $KUBERNETES_SERVICE_HOST
10.96.0.1

The API’s only available over HTTPS. You can find the certificate authority file for your cluster at /var/run/secrets/kubernetes.io/serviceaccount/ca.crt within your Pod. Kubernetes deposits this into the filesystem each time a new container is created.

You’ll need to authenticate to achieve anything useful with the API. Kubernetes creates a new service account for each Pod and provides its token at /var/run/secrets/kubernetes.io/serviceaccount/token. This should be included with each HTTP request as a bearer token in the Authorization header.

Putting everything together, here’s an example of making a basic in-Pod Kubernetes API request using curl:

$ curl
–cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-H “Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)”
https://kubernetes.default.svc/api
{
“kind”: “APIVersions”,
“versions”: [
“v1″
],
“serverAddressByClientCIDRs”: [
{
“clientCIDR”: “0.0.0.0/0”,
“serverAddress”: “192.168.49.2:8443″
}
]

The Kubernetes server has responded with the API versions that are available. This confirms a successful connection has been made using the kubernetes.default.svc hostname and the provided service account.

Handling RBAC

Although an API request has been successfully made, most others will be off-limits if RBAC is enabled for your cluster. Newly created service accounts don’t automatically receive roles so your Pod won’t be able to request protected API endpoints.

You can resolve this by creating your own Role objects and binding them to the service account that’s provided to your Pods. First create a new Role:

apiVersion: rbac.authorization.k8s.io/v1
kind
: Role
metadata
:
namespace
: default
name
: demo-role
rules
:
– apiGroups
: [“”]
resources
: [“pods”]
verbs
: [“get”, “list”]

Apply it to your cluster with Kubectl:

$ kubectl apply -f role.yaml

Next bind the role to the service account:

apiVersion: rbac.authorization.k8s.io/v1
kind
: RoleBinding
metadata
:
namespace
: default
name
: demo-role-binding
subjects
:
– kind
: ServiceAccount
name
: default
apiGroup
: “”
roleRef
:
kind
: Role
name
: demo-role
apiGroup
: “”

The default service account is selected as the role binding’s subject. Pods are always supplied with this service account, scoped to the namespace they were created in. In this example, the default namespace is used, but this should be changed on the Role and RoleBinding objects if your Pod exists in a different namespace.

Add the RoleBinding to your cluster:

$ kubectl apply -f role-binding.yaml

Now your Pods will be permitted to get and list other Pod objects in the default namespace. You can verify this by making an API request to the namespaced Pods endpoint:

$ curl
–cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-H “Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)”
https://kubernetes.default.svc/api/v1/namespaces/default/pods
{
“kind”: “PodList”,
“apiVersion”: “v1″
…
}

Pods can identify their own namespace by reading the /var/run/secrets/kubernetes.io/serviceaccount/namespace file:

$ cat /var/run/secrets/kubernetes.io/serviceaccount/namespace
default

This provides a convenient method for interpolating the active namespace into endpoint URLs:

$ curl
–cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-H “Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)”
https://kubernetes.default.svc/api/v1/namespaces/$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)/pods
{
“kind”: “PodList”,
“apiVersion”: “v1″
…
}

Choosing a Different Service Account

Kubernetes automatically provides Pods with the default service account inside their namespace. You can optionally inject a different service account instead by setting the spec.serviceAccountName field on your Pods:

apiVersion: v1
kind
: Pod
metadata
:
name
: demo
spec
:
serviceAccountName
: demo-sa

In this example the Pod will authenticate as the demo-sa token. You can create this service account manually and bind it the roles you require.

$ kubernetes create serviceaccount demo-sa

The service account should exist in the same namespace as the Pod.

Opting Out of Service Account Mounting

Automatic service account injection isn’t always desirable. It can be a security hazard as a successful Pod compromise offers immediate access to your Kubernetes cluster’s API. You can disable service account token mounts with the spec.automountServiceAccountToken Pod manifest field:

apiVersion: v1
kind
: Pod
metadata
:
name
: demo
spec
:
automountServiceAccountToken
: false

Kubernetes won’t inject the /var/run/secrets/kubernetes.io/serviceaccount/token file. This will prevent the Pod from authenticating to the Kubernetes API unless you manually supply credentials using a different method. This field is also supported on service account objects, making them ineligible to be auto-mounted into any Pod.

If you do use service account mounting, set appropriate RBAC policies to restrict the token to your intended use cases. Avoiding highly privileged access will lessen the risk of damage should an attacker gain access to your Pod.

Summary

Accessing the Kubernetes API server from within your cluster lets running applications inspect and modify neighbouring workloads. You can add extra functionality without opening up your cluster to external API access.

The official client libraries make it simple to get up and running, if they’re suitable for your use case. In other situations you’ll need to manually make requests to https://kubernetes.default.svc, supplying the certificate authority file and service account token that Kubernetes injects into your Pod containers. Irrespective of the approach you use, the service account must be correctly configured with RBAC role bindings so the Pod has permission to perform its intended actions.



Source by www.howtogeek.com

Related Posts

How to Use the Text Command Excel
How To

How to Use the Text Command Excel

November 22, 2023
How to Communicate with Beeper Codes
How To

How to Communicate with Beeper Codes

November 4, 2024
transfer whatsapp from android to iphone
Articles

How to Transfer WhatsApp from Android to iPhone!

October 6, 2023
How to prevent phishing attacks
How To

How to Prevent Phishing Attacks: Safeguarding Your Digital Identity

May 14, 2023

Recommended.

Apple russian apps

Apple pulls major Russian apps from the App Store

September 28, 2022
Map showing Taiwan, mainland China and locations where China is holding military exercises until Sunday

China, Taiwan play high-seas ‘cat and mouse’ as drills wrap up | News

August 7, 2022

Trending.

No Content Available
  • Home
  • About
  • Contact
  • Privacy
  • Terms
  • DCMA
  • Write For Us / Submit
Contact us for submission queries. editor[at]geekyinsider.com.
No Result
View All Result
  • Home
  • Review
  • Apple
  • Gaming
  • Gadget and Gear
    • Camera
    • Smartphone
  • Microsoft
  • Security