{"id":497124,"date":"2022-09-30T03:48:05","date_gmt":"2022-09-30T00:48:05","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/how-to-access-your-kubernetes-clusters-api-from-within-your-pods\/"},"modified":"2022-09-30T03:48:05","modified_gmt":"2022-09-30T00:48:05","slug":"how-to-access-your-kubernetes-clusters-api-from-within-your-pods","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/how-to-access-your-kubernetes-clusters-api-from-within-your-pods\/","title":{"rendered":"#How to Access Your Kubernetes Cluster\u2019s API From Within Your Pods"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6aefdce7e7ef3\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6aefdce7e7ef3\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-1'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-access-your-kubernetes-clusters-api-from-within-your-pods\/#%E2%80%9CHow_to_Access_Your_Kubernetes_Clusters_API_From_Within_Your_Pods%E2%80%9D\" >&#8220;How to Access Your Kubernetes Cluster\u2019s API From Within Your Pods&#8221;<\/a><ul class='ez-toc-list-level-2' ><li class='ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-access-your-kubernetes-clusters-api-from-within-your-pods\/#Why_Access_The_Kubernetes_API_Within_Pods\" >Why Access The Kubernetes API Within Pods?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-access-your-kubernetes-clusters-api-from-within-your-pods\/#Using_the_API_Client_Libraries\" >Using the API Client Libraries<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-access-your-kubernetes-clusters-api-from-within-your-pods\/#Performing_Manual_API_Interactions\" >Performing Manual API Interactions<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-access-your-kubernetes-clusters-api-from-within-your-pods\/#Handling_RBAC\" >Handling RBAC<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-access-your-kubernetes-clusters-api-from-within-your-pods\/#Choosing_a_Different_Service_Account\" >Choosing a Different Service Account<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-access-your-kubernetes-clusters-api-from-within-your-pods\/#Opting_Out_of_Service_Account_Mounting\" >Opting Out of Service Account Mounting<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-access-your-kubernetes-clusters-api-from-within-your-pods\/#Summary\" >Summary<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h1><span class=\"ez-toc-section\" id=\"%E2%80%9CHow_to_Access_Your_Kubernetes_Clusters_API_From_Within_Your_Pods%E2%80%9D\"><\/span>&#8220;How to Access Your Kubernetes Cluster\u2019s API From Within Your Pods&#8221;<span class=\"ez-toc-section-end\"><\/span><\/h1>\n<div>\n<img loading=\"lazy\" decoding=\"async\" class=\"type:primaryImage alignnone size-full wp-image-803403\" data-pagespeed-no-defer=\"\" src=\"https:\/\/www.howtogeek.com\/wp-content\/uploads\/2022\/05\/Kubernetes.jpg?width=1198&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"Kubernetes logo\" width=\"1602\" height=\"902\"\/><\/p>\n<p>The Kubernetes API is your route to inspecting and managing your cluster\u2019s operations. You can consume the API using the Kubectl CLI, tools such as <code>curl<\/code>, or the official integration <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/kubernetes.io\/docs\/reference\/using-api\/client-libraries\">libraries<\/a> for popular programming languages.<\/p>\n<p>The API is available to <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>lications within your cluster too. Kubernetes Pods are automatically given access to the API and can authenticate using a provided service account. You perform interactions by consuming the injected environment variables and certificate files to make connections from the client of your choice.<\/p>\n<h2 id=\"why-access-kubernetes-api-within-pods\"><span class=\"ez-toc-section\" id=\"Why_Access_The_Kubernetes_API_Within_Pods\"><\/span>Why Access The Kubernetes API Within Pods?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>There are several use cases for in-Pod API access. This technique allows applications to dynamically inspect their environment, apply Kubernetes changes, and collect control plane metrics that provide performance insights.<\/p>\n<p>Some organizations develop their own tooling around Kubernetes. They might deploy a special in-cluster application that uses the API to expose additional functionality. Operating from within the cluster can be safer than making API calls from an external script as you don\u2019t need to open up your environment or share service accounts and authentication tokens.<\/p>\n<h2 id=\"using-the-api-client-libraries\"><span class=\"ez-toc-section\" id=\"Using_the_API_Client_Libraries\"><\/span>Using the API Client Libraries<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The easiest and recommended method for accessing the Kubernetes API from a Pod is to use a client library. Fully supported options <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/kubernetes.io\/docs\/reference\/using-api\/client-libraries\">are available for<\/a> C, .NET, Go, Haskell, Java, JavaScript, Perl, Python, and Ruby. There are equivalent <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/kubernetes.io\/docs\/reference\/using-api\/client-libraries\/#community-maintained-client-libraries\">community-maintained solutions<\/a> for most other popular programming languages.<\/p>\n<p>The client libraries have built-in support for discovering the cluster environment they\u2019re running in. Each implementation provides a function you can call that will configure the library to connect to the correct API server.<\/p>\n<p>Here\u2019s an example of how to list the Pods in your cluster within a Python application:<\/p>\n<div class=\"wp-geshi-highlight-wrap5\">\n<div class=\"wp-geshi-highlight-wrap4\">\n<div class=\"wp-geshi-highlight-wrap3\">\n<div class=\"wp-geshi-highlight-wrap2\">\n<div class=\"wp-geshi-highlight-wrap\">\n<div class=\"wp-geshi-highlight\">\n<div class=\"python\">\n<pre class=\"de1\"><span class=\"kw1\">from<\/span> kubernetes <span class=\"kw1\">import<\/span> client<span class=\"sy0\">,<\/span> config\n\u00a0\nconfig.<span class=\"me1\">load_incluster_config<\/span><span class=\"br0\">(<\/span><span class=\"br0\">)<\/span>\n\u00a0\napi <span class=\"sy0\">=<\/span> client.<span class=\"me1\">CoreV1Api<\/span><span class=\"br0\">(<\/span><span class=\"br0\">)<\/span>\n\u00a0\n<span class=\"co1\"># Perform necessary API interactions<\/span>\n<span class=\"co1\"># pods = api.list_pod_for_all_namespaces()<\/span><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p>This approach is easy to work with and requires no manual configuration. Sometimes you won\u2019t be able to use a client library though. In those cases, it\u2019s still possible to manually access the API using the service account Kubernetes provides.<\/p>\n<h2 id=\"performing-manual-api-interactions\"><span class=\"ez-toc-section\" id=\"Performing_Manual_API_Interactions\"><\/span>Performing Manual API Interactions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>To call the API you need to know two things: the in-cluster hostname it\u2019s exposed on, and the service account token that will authenticate your Pod.<\/p>\n<p>The API hostname is always <code>kubernetes.default.svc<\/code>. The Kubernetes DNS provider will resolve this name to the control plane\u2019s API server. Alternatively, you can use the <code>$KUBERNETES_SERVICE_HOST<\/code> environment variable to discover the API server\u2019s IP address:<\/p>\n<pre>$ echo $KUBERNETES_SERVICE_HOST&#13;\n10.96.0.1<\/pre>\n<p>The API\u2019s only available over HTTPS. You can find the certificate authority file for your cluster at <code>\/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt<\/code> within your Pod. Kubernetes deposits this into the filesystem each time a new container is created.<\/p>\n<p>You\u2019ll need to authenticate to achieve anything useful with the API. Kubernetes creates a new <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/kubernetes.io\/docs\/tasks\/configure-pod-container\/configure-service-account\">service account<\/a> for each Pod and provides its token at <code>\/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token<\/code>. This should be included with each HTTP request as a bearer token in the <code>Authorization<\/code> header.<\/p>\n<p>Putting everything together, here\u2019s an example of making a basic in-Pod Kubernetes API request using <code>curl<\/code>:<\/p>\n<pre>$ curl \\&#13;\n  --cacert \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt \\&#13;\n  -H \"Authorization: Bearer $(cat \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token)\"&#13;\n  https:\/\/kubernetes.default.svc\/api&#13;\n{&#13;\n  \"kind\": \"APIVersions\",&#13;\n  \"versions\": [&#13;\n    \"v1\"&#13;\n  ],&#13;\n  \"serverAddressByClientCIDRs\": [&#13;\n    {&#13;\n      \"clientCIDR\": \"0.0.0.0\/0\",&#13;\n      \"serverAddress\": \"192.168.49.2:8443\"&#13;\n    }&#13;\n  ]<\/pre>\n<p>The Kubernetes server has responded with the API versions that are available. This confirms a successful connection has been made using the <code>kubernetes.default.svc<\/code> hostname and the provided service account.<\/p>\n<h2 id=\"handling-rbac\"><span class=\"ez-toc-section\" id=\"Handling_RBAC\"><\/span>Handling RBAC<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Although an API request has been successfully made, most others will be off-limits if <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/rbac\">RBAC<\/a> is enabled for your cluster. Newly created service accounts don\u2019t automatically receive roles so your Pod won\u2019t be able to request protected API endpoints.<\/p>\n<p>You can resolve this by creating your own Role objects and binding them to the service account that\u2019s provided to your Pods. First create a new Role:<\/p>\n<div class=\"wp-geshi-highlight-wrap5\">\n<div class=\"wp-geshi-highlight-wrap4\">\n<div class=\"wp-geshi-highlight-wrap3\">\n<div class=\"wp-geshi-highlight-wrap2\">\n<div class=\"wp-geshi-highlight-wrap\">\n<div class=\"wp-geshi-highlight\">\n<div class=\"yaml\">\n<pre class=\"de1\"><span class=\"co3\">apiVersion<\/span><span class=\"sy2\">: <\/span>rbac.authorization.k8s.io\/v1<span class=\"co3\">\nkind<\/span><span class=\"sy2\">: <\/span>Role<span class=\"co4\">\nmetadata<\/span>:<span class=\"co3\">\n  namespace<\/span><span class=\"sy2\">: <\/span>default<span class=\"co3\">\n  name<\/span><span class=\"sy2\">: <\/span>demo-role<span class=\"co4\">\nrules<\/span>:<span class=\"co3\">\n  - apiGroups<\/span><span class=\"sy2\">: <\/span><span class=\"br0\">[<\/span><span class=\"st0\">\"\"<\/span><span class=\"br0\">]<\/span><span class=\"co3\">\n    resources<\/span><span class=\"sy2\">: <\/span><span class=\"br0\">[<\/span><span class=\"st0\">\"pods\"<\/span><span class=\"br0\">]<\/span><span class=\"co3\">\n    verbs<\/span><span class=\"sy2\">: <\/span><span class=\"br0\">[<\/span><span class=\"st0\">\"get\"<\/span>, <span class=\"st0\">\"list\"<\/span><span class=\"br0\">]<\/span><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p>Apply it to your cluster with Kubectl:<\/p>\n<pre>$ kubectl apply -f role.yaml<\/pre>\n<p>Next bind the role to the service account:<\/p>\n<div class=\"wp-geshi-highlight-wrap5\">\n<div class=\"wp-geshi-highlight-wrap4\">\n<div class=\"wp-geshi-highlight-wrap3\">\n<div class=\"wp-geshi-highlight-wrap2\">\n<div class=\"wp-geshi-highlight-wrap\">\n<div class=\"wp-geshi-highlight\">\n<div class=\"yaml\">\n<pre class=\"de1\"><span class=\"co3\">apiVersion<\/span><span class=\"sy2\">: <\/span>rbac.authorization.k8s.io\/v1<span class=\"co3\">\nkind<\/span><span class=\"sy2\">: <\/span>RoleBinding<span class=\"co4\">\nmetadata<\/span>:<span class=\"co3\">\n  namespace<\/span><span class=\"sy2\">: <\/span>default<span class=\"co3\">\n  name<\/span><span class=\"sy2\">: <\/span>demo-role-binding<span class=\"co4\">\nsubjects<\/span>:<span class=\"co3\">\n  - kind<\/span><span class=\"sy2\">: <\/span>ServiceAccount<span class=\"co3\">\n    name<\/span><span class=\"sy2\">: <\/span>default<span class=\"co3\">\n    apiGroup<\/span><span class=\"sy2\">: <\/span><span class=\"st0\">\"\"<\/span><span class=\"co4\">\nroleRef<\/span>:<span class=\"co3\">\n  kind<\/span><span class=\"sy2\">: <\/span>Role<span class=\"co3\">\n  name<\/span><span class=\"sy2\">: <\/span>demo-role<span class=\"co3\">\n  apiGroup<\/span><span class=\"sy2\">: <\/span><span class=\"st0\">\"\"<\/span><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p>The <code>default<\/code> service account is selected as the role binding\u2019s subject. Pods are always supplied with this service account, scoped to the namespace they were created in. In this example, the <code>default<\/code> namespace is used, but this should be changed on the Role and RoleBinding objects if your Pod exists in a different namespace.<\/p>\n<p>Add the RoleBinding to your cluster:<\/p>\n<pre>$ kubectl apply -f role-binding.yaml<\/pre>\n<p>Now your Pods will be permitted to get and list other Pod objects in the <code>default<\/code> namespace. You can verify this by making an API request to the namespaced Pods endpoint:<\/p>\n<pre>$ curl \\&#13;\n  --cacert \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt \\&#13;\n  -H \"Authorization: Bearer $(cat \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token)\"&#13;\n  https:\/\/kubernetes.default.svc\/api\/v1\/namespaces\/default\/pods&#13;\n{&#13;\n  \"kind\": \"PodList\",&#13;\n  \"apiVersion\": \"v1\"&#13;\n  ...&#13;\n}<\/pre>\n<p>Pods can identify their own namespace by reading the <code>\/var\/run\/secrets\/kubernetes.io\/serviceaccount\/namespace<\/code> file:<\/p>\n<pre>$ cat \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/namespace&#13;\ndefault<\/pre>\n<p>This provides a convenient method for interpolating the active namespace into endpoint URLs:<\/p>\n<pre>$ curl \\&#13;\n  --cacert \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/ca.crt \\&#13;\n  -H \"Authorization: Bearer $(cat \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token)\"&#13;\n  https:\/\/kubernetes.default.svc\/api\/v1\/namespaces\/$(cat \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/namespace)\/pods&#13;\n{&#13;\n  \"kind\": \"PodList\",&#13;\n  \"apiVersion\": \"v1\"&#13;\n  ...&#13;\n}<\/pre>\n<h2 id=\"choosing-a-different-service-account\"><span class=\"ez-toc-section\" id=\"Choosing_a_Different_Service_Account\"><\/span>Choosing a Different Service Account<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Kubernetes automatically provides Pods with the <code>default<\/code> service account inside their namespace. You can optionally inject a different service account instead by setting the <code>spec.serviceAccountName<\/code> field on your Pods:<\/p>\n<div class=\"wp-geshi-highlight-wrap5\">\n<div class=\"wp-geshi-highlight-wrap4\">\n<div class=\"wp-geshi-highlight-wrap3\">\n<div class=\"wp-geshi-highlight-wrap2\">\n<div class=\"wp-geshi-highlight-wrap\">\n<div class=\"wp-geshi-highlight\">\n<div class=\"yaml\">\n<pre class=\"de1\"><span class=\"co3\">apiVersion<\/span><span class=\"sy2\">: <\/span>v1<span class=\"co3\">\nkind<\/span><span class=\"sy2\">: <\/span>Pod<span class=\"co4\">\nmetadata<\/span>:<span class=\"co3\">\n  name<\/span><span class=\"sy2\">: <\/span>demo<span class=\"co4\">\nspec<\/span>:<span class=\"co3\">\n  serviceAccountName<\/span><span class=\"sy2\">: <\/span>demo-sa<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p>In this example the Pod will authenticate as the <code>demo-sa<\/code> token. You can create this service account manually and bind it the roles you require.<\/p>\n<pre>$ kubernetes create serviceaccount demo-sa<\/pre>\n<p>The service account should exist in the same namespace as the Pod.<\/p>\n<h2 id=\"opting-out-of-service-account-mounting\"><span class=\"ez-toc-section\" id=\"Opting_Out_of_Service_Account_Mounting\"><\/span>Opting Out of Service Account Mounting<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Automatic service account injection isn\u2019t always desirable. It can be a security hazard as a successful Pod compromise offers im<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/social-mediaa\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Social Media\" target=\"_blank\" rel=\"noopener\">media<\/a>te access to your Kubernetes cluster\u2019s API. You can disable service account token mounts with the <code>spec.automountServiceAccountToken<\/code> Pod manifest field:<\/p>\n<div class=\"wp-geshi-highlight-wrap5\">\n<div class=\"wp-geshi-highlight-wrap4\">\n<div class=\"wp-geshi-highlight-wrap3\">\n<div class=\"wp-geshi-highlight-wrap2\">\n<div class=\"wp-geshi-highlight-wrap\">\n<div class=\"wp-geshi-highlight\">\n<div class=\"yaml\">\n<pre class=\"de1\"><span class=\"co3\">apiVersion<\/span><span class=\"sy2\">: <\/span>v1<span class=\"co3\">\nkind<\/span><span class=\"sy2\">: <\/span>Pod<span class=\"co4\">\nmetadata<\/span>:<span class=\"co3\">\n  name<\/span><span class=\"sy2\">: <\/span>demo<span class=\"co4\">\nspec<\/span>:<span class=\"co3\">\n  automountServiceAccountToken<\/span><span class=\"sy2\">: <\/span>false<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p>Kubernetes won\u2019t inject the <code>\/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token<\/code> file. This will prevent the Pod from authenticating to the Kubernetes API unless you manually supply credentials using a different method. This field is also supported on service account objects, making them ineligible to be auto-mounted into any Pod.<\/p>\n<p>If you do use service account mounting, set appropriate RBAC policies to restrict the token to your intended use cases. Avoiding highly privileged access will lessen the risk of damage should an attacker gain access to your Pod.<\/p>\n<h2 id=\"summary\"><span class=\"ez-toc-section\" id=\"Summary\"><\/span>Summary<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Accessing the Kubernetes API server from within your cluster lets running applications inspect and modify neighbouring workloads. You can add extra functionality without opening up your cluster to external API access.<\/p>\n<p>The official client libraries make it simple to get up and running, if they\u2019re suitable for your use case. In other situations you\u2019ll need to manually make requests to <code>https:\/\/kubernetes.default.svc<\/code>, supplying the certificate authority file and service account token that Kubernetes injects into your Pod containers. Irrespective of the approach you use, the service account must be correctly configured with RBAC role bindings so the Pod has permission to perform its intended actions.<\/p>\n<\/div>\n<p><script>\n setTimeout(function(){\n  !function(f,b,e,v,n,t,s)\n  {if(f.fbq)return;n=f.fbq=function(){n.callMethod?\n  n.callMethod.apply(n,arguments):n.queue.push(arguments)};\n  if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';\n  n.queue=[];t=b.createElement(e);t.async=!0;\n  t.src=v;s=b.getElementsByTagName(e)[0];\n  s.parentNode.insertBefore(t,s) } (window, document,'script',\n  'https:\/\/connect.facebook.net\/en_US\/fbevents.js');\n   fbq('init', '335401813750447');\n   fbq('track', 'PageView');\n  },3000);\n<\/script><\/p>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/technology\/\" target=\"_blank\" rel=\"noopener\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.howtogeek.com\/devops\/how-to-access-your-kubernetes-clusters-api-from-within-your-pods\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;How to Access Your Kubernetes Cluster\u2019s API From Within Your Pods&#8221; The Kubernetes API is your route to inspecting and managing your cluster\u2019s operations. You can consume the API using the Kubectl CLI, tools such as curl, or the official integration libraries for popular programming languages. The API is available to applications within your cluster&#8230;<\/p>\n","protected":false},"author":1,"featured_media":497125,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.howtogeek.com\/wp-content\/uploads\/2022\/05\/Kubernetes.jpg?height=200p&trim=2,2,2,2","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-497124","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/497124","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=497124"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/497124\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/497125"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=497124"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=497124"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=497124"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}