Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix in-cluster API discovery documentation #36691

Merged
merged 4 commits into from Jan 18, 2023
Merged

Fix in-cluster API discovery documentation #36691

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ae1fa53
Fix in-cluster API discovery documentation
olix0r Sep 8, 2022
ee12363
Review feedback
olix0r Sep 20, 2022
e4c2901
Fixup
olix0r Sep 20, 2022
ae32205
Merge branch 'kubernetes:main' into patch-1
olix0r Jan 18, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
16 changes: 12 additions & 4 deletions content/en/docs/tasks/run-application/access-api-from-pod.md
View file
Open in desktop
Expand Up @@ -42,10 +42,18 @@ securely with the API server.

### Directly accessing the REST API

While running in a Pod, the Kubernetes apiserver is accessible via a Service named
`kubernetes` in the `default` namespace. Therefore, Pods can use the
`kubernetes.default.svc` hostname to query the API server. Official client libraries
do this automatically.
While running in a Pod, your container can create an HTTPS URL for the Kubernetes API
server by fetching the `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT_HTTPS`
environment variables. The API server's in-cluster address is also published to a
Service named `kubernetes` in the `default` namespace so that pods may reference
`kubernetes.default.svc` as a DNS name for the local API server.

{{< note >}}
Kubernetes does not guarantee that the API server has a valid certificate for
the hostname `kubernetes.default.svc`;
however, the control plane **is** expected to present a valid certificate for the
hostname or IP address that `$KUBERNETES_SERVICE_HOST` represents.
{{< /note >}}

The recommended way to authenticate to the API server is with a
[service account](/docs/tasks/configure-pod-container/configure-service-account/)
Expand Down