Documentation
¶
Overview ¶
Package clusterinfo discovers the external Kubernetes API server endpoint and trust anchor without requiring them to be configured explicitly.
The primary source is the standard cluster-info ConfigMap in the kube-public namespace, which kubeadm-provisioned clusters (including kind) publish. Some managed control planes (notably AKS) do not publish it; for those, DiscoverURL falls back to the KUBERNETES_SERVICE_HOST/PORT the kubelet injects, but only when it resolves to an external FQDN rather than the in-cluster ClusterIP (on AKS the kubernetes.azure.com/set-kube-service-host-fqdn pod annotation makes it the public API FQDN). The CA for that fallback comes from the in-cluster service-account mount (see InClusterCA).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DiscoverURL ¶
DiscoverURL resolves only the external API server URL, preferring the kube-public/cluster-info ConfigMap and falling back to the KUBERNETES_SERVICE_HOST FQDN (see KubeServiceHostEndpoint).
Unlike a CA-inclusive resolve it never reads the in-cluster CA, so callers that advertise only the endpoint (e.g. the operator) do not fail when the CA mount is unavailable or unreadable.
func InClusterCA ¶
InClusterCA reads the service-account CA bundle the kubelet mounts into every pod. It is the cluster CA and signs the API server serving certificate (including the AKS FQDN SAN), so it is the correct trust anchor for the KUBERNETES_SERVICE_HOST fallback when cluster-info is unavailable.
func KubeServiceHostEndpoint ¶
KubeServiceHostEndpoint builds the API server URL from the KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT_HTTPS/PORT environment variables the kubelet injects into pods.
It returns ok=false unless the host is an external FQDN: an empty value, an IP literal (the in-cluster ClusterIP), or an in-cluster Service DNS name (kubernetes.default.svc, ...) is rejected, since none of those are reachable by a node that is still joining the cluster. On AKS the kubernetes.azure.com/set-kube-service-host-fqdn pod annotation makes this env the public API FQDN, which is accepted.
func ResolveApiserverURL
deprecated
ResolveApiserverURL reads the standard cluster-info ConfigMap from the kube-public namespace and returns the Kubernetes API server URL contained in the embedded kubeconfig.
Deprecated: Use Resolve instead, which also returns the CA certificate from the same kubeconfig.
Types ¶
type ClusterInfo ¶
type ClusterInfo struct {
// ApiserverURL is the external API server URL (e.g. "https://10.0.0.1:6443").
ApiserverURL string
// CACertPEM is the PEM-encoded cluster CA certificate.
CACertPEM []byte
}
ClusterInfo holds the API server URL and CA certificate discovered from the standard cluster-info ConfigMap in kube-public.
func Resolve ¶
func Resolve(ctx context.Context, clientset kubernetes.Interface) (*ClusterInfo, error)
Resolve reads the standard cluster-info ConfigMap from the kube-public namespace and returns both the API server URL and the CA certificate from the embedded kubeconfig. Clusters provisioned by kubeadm (including kind) publish this ConfigMap; Discover layers a fallback on top for those that do not.
Source Files