Schille
commented
1 year ago @schwobaseggl Here's my PoC with k3d.
1) Create cluster
k3d cluster create mycluster --agents 1 -p 8080:80@agent:0 -p 31820:31820/UDP@agent:0
2) Run a Pod with Ubuntu in mycluster
apiVersion: v1
kind: Pod
metadata:
name: ubuntu
spec:
containers:
- name: ubuntu
image: ubuntu
command:
- sleep
- infinity3) Retrieve Kubernetes certificate and SA token from ubuntu
- Create an archive within the Pod
cd /var tar -cz run/secrets/kubernetes.io -f sa.tar.gz - Copy it to the current directory on the host
kubectl cp ubuntu:var/sa.tar.gz ./sa.tar.gz - install
curlapt update && apt install -y curl
4) Setup a Gefyra container
gefyra upgefyra run --image ubuntu --name ubuntu --rm -c "sleep infinity"
5) Copy the Kubernetes certificate and SA token to Gefyra container from the current directory on the host
docker cp sa.tar.gz ubuntu:var/sa.tar.gz6) Prepare Gefyra container with curl and the copied data
docker exec -it ubuntu bash- Bash on the local Gefyra container
cd /var tar -xzvf sa.tar.gz apt update && apt install -y curl
In both shells (K3d running Pod and local Gefyra container), this should work:
APISERVER=https://kubernetes
# Path to ServiceAccount token
SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount
# Read this Pod's namespace
NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace)
# Read the ServiceAccount bearer token
TOKEN=$(cat ${SERVICEACCOUNT}/token)
# Reference the internal certificate authority (CA)
CACERT=${SERVICEACCOUNT}/ca.crt
# Explore the API with TOKEN
curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api
{
"kind": "APIVersions",
"versions": [
"v1"
],
"serverAddressByClientCIDRs": [
{
"clientCIDR": "0.0.0.0/0",
"serverAddress": "172.20.0.2:6443"
}
]
}
schwobaseggl
What is the new feature about?
At the least, those two are required in order to connect a locally running container with the remote K8s API through an internal path:
KUBERNETES_SERVICE_HOST- ipKUBERNETES_SERVICE_PORT- portIn addition, it would be a nice to have to get/assign a service account for the local container.
Why would such a feature be important to you?
When writing applications that communicate with K8s API server, it would be important to make the address available to the locally running container.
Anything else we need to know?
No response