whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add jsonpath approach for apiserver query (#12350)

Browse Source 
* Add `jsonpath` approach for apiserver query

* Refine the wording with the approach description

* Refine the command log

* Move the itemized number back
This commit is contained in:
chenrui
2019-01-28 01:18:54 -05:00
committed by Kubernetes Prow Robot
parent e30a39af27
commit ca4f474235
2 changed files with 49 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/tasks/access-application-cluster/access-cluster.md
+27 -1
View File
@@ -78,9 +78,35 @@ $ curl http://localhost:8080/api/
Use `kubectl describe secret...` to get the token for the default service account: Use `kubectl describe secret...` to get the token for the default service account:
Use `kubectl describe secret` with grep/cut:
```shell ```shell
$ APISERVER=$(kubectl config view --minify | grep server | cut -f 2- -d ":" | tr -d " ") $ APISERVER=$(kubectl config view --minify | grep server | cut -f 2- -d ":" | tr -d " ")
$ TOKEN=$(kubectl describe secret $(kubectl get secrets | grep "^default" | cut -f1 -d ' ') | grep -E '^token' | cut -f2 -d':' | tr -d " ") $ SECRET_NAME=$(kubectl get secrets | grep ^default | cut -f1 -d ' ')
$ TOKEN=$(kubectl describe secret $SECRET_NAME | grep -E '^token' | cut -f2 -d':' | tr -d " ")
$ curl $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure
{
"kind": "APIVersions",
"versions": [
"v1"
],
"serverAddressByClientCIDRs": [
{
"clientCIDR": "0.0.0.0/0",
"serverAddress": "10.0.1.149:443"
}
]
}
```
Using `jsonpath`:
```shell
$ APISERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
$ SECRET_NAME=$(kubectl get serviceaccount default -o jsonpath='{.secrets[0].name}')
$ TOKEN=$(kubectl get secret $SECRET_NAME -o jsonpath='{.data.token}' | base64 --decode)
$ curl $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure $ curl $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure
{ {
"kind": "APIVersions", "kind": "APIVersions",
content/en/docs/tasks/administer-cluster/access-cluster-api.md
+22
View File
@@ -85,6 +85,8 @@ The output is similar to this:
It is possible to avoid using kubectl proxy by passing an authentication token It is possible to avoid using kubectl proxy by passing an authentication token
directly to the API server, like this: directly to the API server, like this:
Using `grep/cut` approach:
``` shell ``` shell
# Check all possible clusters, as you .KUBECONFIG may have multiple contexts # Check all possible clusters, as you .KUBECONFIG may have multiple contexts
kubectl config view -o jsonpath='{range .clusters[*]}{.name}{"\t"}{.cluster.server}{"\n"}{end}' kubectl config view -o jsonpath='{range .clusters[*]}{.name}{"\t"}{.cluster.server}{"\n"}{end}'
@@ -116,6 +118,26 @@ The output is similar to this:
} }
``` ```
Using `jsonpath` approach:
```
$ APISERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
$ TOKEN=$(kubectl get secret $(kubectl get serviceaccount default -o jsonpath='{.secrets[0].name}') -o jsonpath='{.data.token}' | base64 --decode )
$ curl $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure
{
"kind": "APIVersions",
"versions": [
"v1"
],
"serverAddressByClientCIDRs": [
{
"clientCIDR": "0.0.0.0/0",
"serverAddress": "10.0.1.149:443"
}
]
}
```
The above example uses the `--insecure` flag. This leaves it subject to MITM The above example uses the `--insecure` flag. This leaves it subject to MITM
attacks. When kubectl accesses the cluster it uses a stored root certificate attacks. When kubectl accesses the cluster it uses a stored root certificate
and client certificates to access the server. (These are installed in the and client certificates to access the server. (These are installed in the