如何直接从节点访问 Kubernetes API

Question

From a Kubernetes node, how can I access API server, how can I find out the API endpoint and handle authentication? It is a Windows node by the way.

I'm surprised that there is not much information I could find on the Internet about this, is accessing Kubernetes API from node directly a bad design?

Answer 1

"From the node" sound like a fringe use case, like addons, which are usually covered by using the "admin.conf" file that was deployed during node attachement and contains whatever you would need to connect to the api server.

A more usual approach would be to deploy your workload in a Pod which service account would have the proper role binding to access the API server.

Answer 2

How to access Kubernetes API from node directly?

• There are multiple ways, one of the way is from master node

# Get API Server URL:
kubectl cluster-info

#access it using the curl 
curl https://<api serverIP>:6443/api/v1/nodes  --cacert /etc/srv/kubernetes/pki/ca-certificates.crt   --cert /var/lib/kubelet/pki/kubelet-client.crt   --key /var/lib/kubelet/pki/kubelet-client.key

how can I find out the API endpoint and handle authentication?

• One technique i use is using --v=11 with kubectl commands, it will give endpoints of the kubernetes resources

#example :
 kubectl get pods --v=11 2>&1 | grep GET
I1229 10:20:41.098241   42907 round_trippers.go:423] curl -k -v -XGET  -H "Accept: application/json;as=Table;v=v1;g=meta.k8s.io,application/json;as=Table;v=v1beta1;g=meta.k8s.io,application/json" -H "User-Agent: kubectl/v1.19.4 (linux/amd64) kubernetes/d360454" 'https://10.157.160.165:6443/api/v1/namespaces/default/pods?limit=500'
I1229 10:20:41.116964   42907 round_trippers.go:443] GET https://<apiserver>:6443/api/v1/namespaces/default/pods?limit=500 200 OK in 18 milliseconds

It is a Windows node by the way

• Ideally above steps should work, May be you need to find out equivalent commands for grep & curl. change location of the certs to appropriate locations. you can find the location of certs from admin.conf file.