Add jsonpath approach for apiserver query (#12350)

* Add `jsonpath` approach for apiserver query

* Refine the wording with the approach description

* Refine the command log

* Move the itemized number back
This commit is contained in:
chenrui
2019-01-28 01:18:54 -05:00
committed by Kubernetes Prow Robot
parent e30a39af27
commit ca4f474235
2 changed files with 49 additions and 1 deletions
@@ -85,6 +85,8 @@ The output is similar to this:
It is possible to avoid using kubectl proxy by passing an authentication token
directly to the API server, like this:
Using `grep/cut` approach:
``` shell
# Check all possible clusters, as you .KUBECONFIG may have multiple contexts
kubectl config view -o jsonpath='{range .clusters[*]}{.name}{"\t"}{.cluster.server}{"\n"}{end}'
@@ -116,6 +118,26 @@ The output is similar to this:
}
```
Using `jsonpath` approach:
```
$ APISERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
$ TOKEN=$(kubectl get secret $(kubectl get serviceaccount default -o jsonpath='{.secrets[0].name}') -o jsonpath='{.data.token}' | base64 --decode )
$ curl $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure
{
"kind": "APIVersions",
"versions": [
"v1"
],
"serverAddressByClientCIDRs": [
{
"clientCIDR": "0.0.0.0/0",
"serverAddress": "10.0.1.149:443"
}
]
}
```
The above example uses the `--insecure` flag. This leaves it subject to MITM
attacks. When kubectl accesses the cluster it uses a stored root certificate
and client certificates to access the server. (These are installed in the