whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove duplicated contents for accessing the API server

Browse Source 
The topic of accessing the API server can be found in two places. This
is not good.
This commit is contained in:
Qiming Teng
2022-03-25 18:48:27 +08:00
parent 3013adb039
commit 58a00cfb36
2 changed files with 5 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/tasks/access-application-cluster/access-cluster.md
+3 -28
View File
@@ -205,35 +205,10 @@ See documentation for other libraries for how they authenticate.
## Accessing the API from a Pod ## Accessing the API from a Pod
When accessing the API from a pod, locating and authenticating When accessing the API from a pod, locating and authenticating
to the apiserver are somewhat different. to the API server are somewhat different.
The recommended way to locate the apiserver within the pod is with Please check [Accessing the API from within a Pod](/docs/tasks/run-application/access-api-from-pod/)
the `kubernetes.default.svc` DNS name, which resolves to a Service IP which in turn for more details.
will be routed to an apiserver.
The recommended way to authenticate to the apiserver is with a
[service account](/docs/tasks/configure-pod-container/configure-service-account/) credential. By kube-system, a pod
is associated with a service account, and a credential (token) for that
service account is placed into the filesystem tree of each container in that pod,
at `/var/run/secrets/kubernetes.io/serviceaccount/token`.
If available, a certificate bundle is placed into the filesystem tree of each
container at `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`, and should be
used to verify the serving certificate of the apiserver.
Finally, the default namespace to be used for namespaced API operations is placed in a file
at `/var/run/secrets/kubernetes.io/serviceaccount/namespace` in each container.
From within a pod the recommended ways to connect to API are:
- Run `kubectl proxy` in a sidecar container in the pod, or as a background
process within the container. This proxies the
Kubernetes API to the localhost interface of the pod, so that other processes
in any container of the pod can access it.
- Use the Go client library, and create a client using the `rest.InClusterConfig()` and `kubernetes.NewForConfig()` functions.
They handle locating and authenticating to the apiserver. [example](https://git.k8s.io/client-go/examples/in-cluster-client-configuration/main.go)
In each case, the credentials of the pod are used to communicate securely with the apiserver.
## Accessing services running on the cluster ## Accessing services running on the cluster
content/en/docs/tasks/run-application/access-api-from-pod.md
+2 -1
View File
@@ -48,7 +48,8 @@ While running in a Pod, the Kubernetes apiserver is accessible via a Service nam
do this automatically. do this automatically.
The recommended way to authenticate to the API server is with a The recommended way to authenticate to the API server is with a
[service account](/docs/tasks/configure-pod-container/configure-service-account/) credential. By default, a Pod [service account](/docs/tasks/configure-pod-container/configure-service-account/)
credential. By default, a Pod
is associated with a service account, and a credential (token) for that is associated with a service account, and a credential (token) for that
service account is placed into the filesystem tree of each container in that Pod, service account is placed into the filesystem tree of each container in that Pod,
at `/var/run/secrets/kubernetes.io/serviceaccount/token`. at `/var/run/secrets/kubernetes.io/serviceaccount/token`.