curl 测试 k8s api

本机 curl 直接使用 k8s 里的证书调用 k8s api

curl -k \
--cert /etc/kubernetes/pki/apiserver-kubelet-client.crt \
--key /etc/kubernetes/pki/apiserver-kubelet-client.key \
--cacert /etc/kubernetes/pki/ca.crt \
https://localhost:6443/api/v1/pods?limit=1

也可将先建一个 sh 文件

例如文件名：curl-k8s-api.sh

curl -k \
--cert /etc/kubernetes/pki/apiserver-kubelet-client.crt \
--key /etc/kubernetes/pki/apiserver-kubelet-client.key \
--cacert /etc/kubernetes/pki/ca.crt \
$@

然后通过 该 sh 文件调用 k8s api

./curl-k8s-api.sh https://localhost:6443/api/v1/pods?limit=1

通过 ~/.kube/config 文件调用 k8s api

# 获取当前上下文
current_context=$(kubectl config current-context)

# 提取必要信息
cluster_name=$(kubectl config view -o jsonpath="{.contexts[?(@.name=='$current_context')].context.cluster}")
api_server=$(kubectl config view -o jsonpath="{.clusters[?(@.name=='$cluster_name')].cluster.server}")
ca_cert=$(kubectl config view -o jsonpath="{.clusters[?(@.name=='$cluster_name')].cluster.certificate-authority}")
user_name=$(kubectl config view -o jsonpath="{.contexts[?(@.name=='$current_context')].context.user}")

# 尝试获取不同认证方式
token=$(kubectl config view -o jsonpath="{.users[?(@.name=='$user_name')].user.token}")

# 如果token为空，尝试其他方式获取
if [ -z "$token" ]; then
  token=$(kubectl get secret $(kubectl get sa default -o jsonpath='{.secrets[0].name}') -o jsonpath='{.data.token}' | base64 --decode)
fi

client_cert=$(kubectl config view -o jsonpath="{.users[?(@.name=='$user_name')].user.client-certificate}")
client_key=$(kubectl config view -o jsonpath="{.users[?(@.name=='$user_name')].user.client-key}")

# 确定使用哪种认证方式
if [ -n "$client_cert" ] && [ -n "$client_key" ]; then
  # 使用客户端证书
  echo "Using client certificate authentication"
  curl --cert "$client_cert" --key "$client_key" --cacert "$ca_cert" "${api_server}/api/v1/namespaces/default/pods"
elif [ -n "$token" ]; then
  # 使用令牌
  echo "Using token authentication"
  if [ -f "$ca_cert" ]; then
    curl -H "Authorization: Bearer $token" --cacert "$ca_cert" "${api_server}/api/v1/namespaces/default/pods"
  else
    # 可能是嵌入式CA证书
    embedded_ca=$(kubectl config view -o jsonpath="{.clusters[?(@.name=='$cluster_name')].cluster.certificate-authority-data}" | base64 --decode)
    curl -H "Authorization: Bearer $token" --cacert <(echo "$embedded_ca") "${api_server}/api/v1/namespaces/default/pods"
  fi
else
  echo "No supported authentication method found in kubeconfig"
  exit 1
fi