Search code examples
restgoogle-oauthkubernetesgoogle-kubernetes-enginebearer-token

How to authenticate against Kubernetes clusters running on Google Container Engine using REST API?

I'm writing an application to monitor a kubernetes cluster running on Google Container Engine. On the host where my application deployed, there are no kubectl and gcloud CLI nor are they allowed to be installed. So I am trying to do everything through REST API.

For creating the cluster through REST, I can use GCE Rest API with bearer token retrieved from Google OAuth Playground. Something like:

curl -i -X GET -H "Accept: application/json" -H "Content-Type: application/json" -H "Content-Length: 0" -H "Authorization: Bearer $MyBearerToken  https://container.googleapis.com/v1/projects/$PROJECT_ID/zones/$ZONE/serverconfig

I can also find Kubernetes REST API reference here. So my question is: How do I retrieve, say pod information, from my GCE Kubernetes cluster, using REST api and REST api only?

I tried with kubectl get pods --v=8, and it's using GET https://${Kubenetes_IP}/api/v1/namespaces/default/pods. But when I use the same api endpoint to curl with my GCE bearer. It gives me Unzuthorized error message.

# curl --insecure -H "Authorization: Bearer $MyBearerToken" https://${Kubenetes_IP}/api/v1/namespaces/default/pods
Unauthorized

I am guessing because I need to use a different bearer token, or some other authentication method. I am wondering if anyone got a quick programtic one-liner? (Without resorting to kubectl or gcloud)

Reference

This answer affirms that there is a way using bearer token, but didn't give a pointer or example

This answer also seems promising, but all the link provided are broken (and api are deprecated as well)

This answer assumes kubectl and gcloud are installed, which is not allowed in my current use case.

Solution

  • Token can be retrieve from Google OAuth Playground

    Kubernetes can be reached by the following curl command via REST API

    # curl --insecure -H "Authorization: Bearer $MyBearerToken" https://${Kubenetes_IP}/api/v1/namespaces/default/pods

    Kubernetes Master IP can be retrieved with kubectl get pods --v=8 and it could probably be retrieved somewhere from GCE Web GUI as well.

    Full Kubernetes REST API can be found here

    Make sure the token has not yet expired, and I think right now the default TTL is 1 hour.