# api

* [acess cluster](#acess-cluster)
  * [access cluster with cacert](#access-cluster-with-cacert)

{% hint style="info" %}
> references:
>
> * [\* Kubernetes API](https://kubernetes.io/docs/reference/kubernetes-api/)
> * [\* Access Clusters Using the Kubernetes API](https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/)
> * [The Kubernetes API](https://kubernetes.io/docs/concepts/overview/kubernetes-api/)
> * [The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750)
> * [\* How to Access Kubernetes API Server](https://blog.codefarm.me/2021/12/18/access-kubernetes/)
> * [\* Access Kubernetes API with Client Certificates](https://blog.codefarm.me/2019/02/01/access-kubernetes-api-with-client-certificates/)
> * [\* Interacting directly with the API](https://kubebyexample.com/learning-paths/operator-framework/kubernetes-api-fundamentals/interacting-directly-api)
> * [\* Kubernetes API Basics - Resources, Kinds, and Objects](https://iximiuz.com/en/posts/kubernetes-api-structure-and-terminology/)
> * [Accessing Clusters](https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/)
> * [\* one-page api reference for kubernetes v1.24](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/)
> * [\* API Access Control](https://kubernetes.io/docs/reference/access-authn-authz/)
> * [using api](https://kubernetes.io/docs/reference/using-api/)
> * [customizing components with the kubeadm api](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/control-plane-flags/)
>   * [workload resources](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/)
>     * Pod
>     * PodTemplate
>     * ReplicationController
>     * ReplicaSet
>     * Deployment
>     * StatefulSet
>     * ControllerRevision
>     * DaemonSet
>     * Job
>     * CronJob
>     * HorizontalPodAutoscaler
>     * PriorityClass
>   * [service resources](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/)
>     * Service
>     * Endpoints
>     * EndpointSlice
>     * Ingress
>     * IngressClass
>   * [config and storage resources](https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/)
>   * [authentication resources](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/)
>   * [authorization resources](https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/)
>   * [policy resources](https://kubernetes.io/docs/reference/kubernetes-api/policy-resources/)
>   * [cluster resources](https://kubernetes.io/docs/reference/kubernetes-api/cluster-resources/)
>     * Node
>     * Namespace
>     * Event
>     * APIService
>     * Lease
>     * RuntimeClass
>     * FlowSchema v1beta2
>     * PriorityLevelConfiguration v1beta2
>     * Binding
>     * ComponentStatus
>   * [common definitions](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/)
{% endhint %}

> \[!NOTE] There are several different proxies you may encounter when using Kubernetes:
>
> * The kubectl proxy:
>   * runs on a user's desktop or in a pod
>   * proxies from a localhost address to the Kubernetes apiserver
>   * client to proxy uses HTTP
>   * proxy to apiserver uses HTTPS
>   * locates apiserver
>   * adds authentication headers
>
> \- The apiserver proxy: - is a bastion built into the apiserver - connects a user outside of the cluster to cluster IPs which otherwise might not be reachable - runs in the apiserver processes - client to proxy uses HTTPS (or http if apiserver so configured) - proxy to target may use HTTP or HTTPS as chosen by proxy using available information - can be used to reach a Node, Pod, or Service - does load balancing when used to reach a Service
>
> \- The kube proxy: - runs on each node - proxies UDP and TCP - does not understand HTTP - provides load balancing - is only used to reach services
>
> \- A Proxy/Load-balancer in front of apiserver(s): - existence and implementation varies from cluster to cluster (e.g. nginx) - sits between all clients and one or more apiservers - acts as load balancer if there are several apiservers.
>
> \- Cloud Load Balancers on external services: - are provided by some cloud providers (e.g. AWS ELB, Google Cloud Load Balancer) - are created automatically when the Kubernetes service has type LoadBalancer - use UDP/TCP only - implementation varies by cloud provider.

![kubernetes API structure](https://1999659500-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MHqOSW6on5cHbtwcSH6%2Fuploads%2Fgit-blob-1ea2b516aa25055c51faa33965dd297e109f2c72%2Fkube-api-structure-3000-opt.png?alt=media)

> \[!NOTE|label:tips:]
>
> *   get server
>
>     ```bash
>     $ server=$(kubectl config view -ojsonpath="{.clusters[*].cluster.server}")
>     ```
> *   get default sa name
>
>     ```bash
>     $ name=$(kubectl get sa -n default default -ojsonpath="{.secrets[].name}")
>     ```
> *   get token
>
>     ```bash
>     $ token=$(kubectl get secrets -n default $(kubectl get sa -n default default -ojsonpath="{.secrets[].name}") -o jsonpath="{.data.token}" | base64 -d)
>     ```
> *   get cacert
>
>     ```bash
>     $ cacert=$(kubectl config view --raw -ojsonpath="{.clusters[].cluster.certificate-authority-data}" | base64 -d)
>     ```
> *   [curl HEAD](https://datatracker.ietf.org/doc/html/rfc6750)
>
>     ```bash
>     -H "Authorization: Bearer $token"
>     ```
> *   API path
>
>     ```bash
>     $ ${server}/api/
>     ```

### acess cluster

```bash
$ APISERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
# or get via cluster name of `kubernetes-staging`
$ APISERVER=$(kubectl config view -o jsonpath='{.clusters[?(@.name == "kubernetes-staging")].cluster.server}')

$ TOKEN=$(kubectl get secret default-token -o jsonpath='{.data.token}' | base64 --decode)
$ curl ${APISERVER}/api --header "Authorization: Bearer ${TOKEN}" --insecure
```

*   or

    ```bash
    $ APISERVER=$(kubectl config view --minify | grep server | cut -f 2- -d ":" | tr -d " ")
    # or via jsonpath
    $ APISERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
    # or get via cluster name of `kubernetes-staging`
    $ APISERVER=$(kubectl config view -o jsonpath='{.clusters[?(@.name == "kubernetes-staging")].cluster.server}')

    $ TOKEN=$(kubectl describe secret default-token | grep -E '^token' | cut -f2 -d':' | tr -d " ")
    $ curl ${APISERVER}/api --header "Authorization: Bearer ${TOKEN}" --insecure
    {
      "kind": "APIVersions",
      "versions": [
        "v1"
      ],
      "serverAddressByClientCIDRs": [
        {
          "clientCIDR": "0.0.0.0/0",
          "serverAddress": "<master.ip>:6443"
        }
      ]
    }
    ```

#### [access cluster with cacert](https://blog.codefarm.me/2021/12/18/access-kubernetes/)

```bash
$ curl --include \
       --cacert <(kubectl config view --raw -ojsonpath="{.clusters[].cluster.certificate-authority-data}" | base64 -d) \
       ${server}/api/ -H "Authorization: Bearer $token"
```
