Direct Access to the Kubernetes API Using Authentication Credentials

Instead of using kubectl in proxy mode, we can provide the location and credentials directly to the HTTP client. This approach can be used if you are using a client that may get confused by proxies, but it is less secure than using the kubectl proxy due to the risk of MITM attacks. To mitigate this risk, it is recommended that you import the root certificate and verify the identity of the API server when using this method.

When thinking about accessing the cluster using credentials, we need to understand how authentication is configured and what authentication plugins are enabled in our cluster. Several authentication plugins can be used, which allow different ways of authenticating with the server:

• Client certificates
• ServiceAccount bearer tokens
• Authenticating proxy
• HTTP basic auth

  Note

  Note that the preceding list includes only some of the authentication plugins. You can learn more about authentication...