From 58a00cfb36ecce57c4c16e6ab949bd2a1bc29f5e Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Fri, 25 Mar 2022 18:48:27 +0800 Subject: [PATCH] Remove duplicated contents for accessing the API server The topic of accessing the API server can be found in two places. This is not good. --- .../access-cluster.md | 31 ++----------------- .../run-application/access-api-from-pod.md | 3 +- 2 files changed, 5 insertions(+), 29 deletions(-) diff --git a/content/en/docs/tasks/access-application-cluster/access-cluster.md b/content/en/docs/tasks/access-application-cluster/access-cluster.md index 8e89e12a59..aae96d3e96 100644 --- a/content/en/docs/tasks/access-application-cluster/access-cluster.md +++ b/content/en/docs/tasks/access-application-cluster/access-cluster.md @@ -205,35 +205,10 @@ See documentation for other libraries for how they authenticate. ## Accessing the API from a Pod When accessing the API from a pod, locating and authenticating -to the apiserver are somewhat different. +to the API server are somewhat different. -The recommended way to locate the apiserver within the pod is with -the `kubernetes.default.svc` DNS name, which resolves to a Service IP which in turn -will be routed to an apiserver. - -The recommended way to authenticate to the apiserver is with a -[service account](/docs/tasks/configure-pod-container/configure-service-account/) credential. By kube-system, a pod -is associated with a service account, and a credential (token) for that -service account is placed into the filesystem tree of each container in that pod, -at `/var/run/secrets/kubernetes.io/serviceaccount/token`. - -If available, a certificate bundle is placed into the filesystem tree of each -container at `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`, and should be -used to verify the serving certificate of the apiserver. - -Finally, the default namespace to be used for namespaced API operations is placed in a file -at `/var/run/secrets/kubernetes.io/serviceaccount/namespace` in each container. - -From within a pod the recommended ways to connect to API are: - - - Run `kubectl proxy` in a sidecar container in the pod, or as a background - process within the container. This proxies the - Kubernetes API to the localhost interface of the pod, so that other processes - in any container of the pod can access it. - - Use the Go client library, and create a client using the `rest.InClusterConfig()` and `kubernetes.NewForConfig()` functions. - They handle locating and authenticating to the apiserver. [example](https://git.k8s.io/client-go/examples/in-cluster-client-configuration/main.go) - -In each case, the credentials of the pod are used to communicate securely with the apiserver. +Please check [Accessing the API from within a Pod](/docs/tasks/run-application/access-api-from-pod/) +for more details. ## Accessing services running on the cluster diff --git a/content/en/docs/tasks/run-application/access-api-from-pod.md b/content/en/docs/tasks/run-application/access-api-from-pod.md index 9eb2521f7f..d56f624cd5 100644 --- a/content/en/docs/tasks/run-application/access-api-from-pod.md +++ b/content/en/docs/tasks/run-application/access-api-from-pod.md @@ -48,7 +48,8 @@ While running in a Pod, the Kubernetes apiserver is accessible via a Service nam do this automatically. The recommended way to authenticate to the API server is with a -[service account](/docs/tasks/configure-pod-container/configure-service-account/) credential. By default, a Pod +[service account](/docs/tasks/configure-pod-container/configure-service-account/) +credential. By default, a Pod is associated with a service account, and a credential (token) for that service account is placed into the filesystem tree of each container in that Pod, at `/var/run/secrets/kubernetes.io/serviceaccount/token`.