Tasks

Loading tasks...

#cka #ckad #kubectl-proxy #api-server #secrets

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge, Easy, on Kubernetes, Networking

Access the Kubernetes API Server via kubectl proxy

by Omkar Shelke

Scenario

You need a one-off way to inspect the raw Kubernetes API response for the Secrets in the gliese-581 namespace. No kubectl get formatting, just the exact JSON the API server returns. kubectl proxy is the standard tool for this: it opens a local HTTP endpoint that forwards straight to the API server, reusing your existing kubeconfig credentials so you do not have to deal with tokens, certificates, or Authorization headers yourself.

Task

Start kubectl proxy on cplane-01, listening on port 8080.
Use curl against the proxy to fetch the list of Secrets in the gliese-581 namespace.
Save the raw JSON response to /home/laborant/secret-list.json.

Important

kubectl proxy runs in the foreground and keeps printing logs. It will not give your terminal back. Either background it with &, or open a second terminal tab for cplane-01 and run curl from there:

new terminal on cplane-01

Hint 1 What Does kubectl proxy Actually Do?

kubectl proxy starts a local HTTP server (on 127.0.0.1:8001 by default) that transparently forwards every request it receives to the real Kubernetes API server, attaching your kubeconfig credentials along the way. That means once the proxy is running, you can curl the Kubernetes API without manually handling bearer tokens, client certs, or --insecure flags. The proxy already did the authenticated part for you.

This challenge requires the proxy to listen on port 8080 instead of the default 8001. Check kubectl proxy --help for the flag that lets you override the listening port.

Documentation

Use kubectl proxy

Hint 2 Keep the Proxy Running

kubectl proxy blocks the terminal it runs in. You have two options. Remember to add the port flag from Hint 1 to both:

# Option A: background it in the same terminal
kubectl proxy <port-flag> &

# Option B: run it in the foreground in one tab,
# and use a second terminal tab for curl
kubectl proxy <port-flag>

Either way works. Confirm it is listening on the right port with:

ss -tlnp | grep 8080

Hint 3 Constructing the Request

You already know the proxy's local address (127.0.0.1:8080) and the namespace you need (gliese-581). What is left is the API path.

Every namespaced resource under the core v1 API group follows the same pattern:

/api/v1/namespaces/<namespace>/<resource-plural>

Work out what <resource-plural> should be for Secrets, and combine it with the proxy's address to build the full URL yourself.

Once you have the URL, check curl --help for the flag that writes a response body straight to a file instead of printing it to your terminal.

Inspect your result with:

jq . /home/laborant/secret-list.json

You should see a "kind": "SecretList" document containing db-credentials, api-token, and ssh-key.

Documentation

Kubernetes API Reference Secret

⚒ Test Cases

Start challenge