Connect Java Maven Apps to Kubernetes with kubeconfig & ServiceAccount

Using kubeconfig file to connect to the cluster

Goal: initialize with as few configuration items as possible to minimize later deployment effort.

Environment variable configuration

Default: KUBECONFIG=~/.kube/config Custom example:

KUBECONFIG=/opt/file/kubeconfig

Example code

import io.fabric8.kubernetes.api.model.Namespace;
import io.fabric8.kubernetes.api.model.NamespaceList;
import io.fabric8.kubernetes.client.KubernetesClient;
import io.fabric8.kubernetes.client.KubernetesClientBuilder;

public class K8sClientWithKubeConfig {
    public static void main(String[] args) {
        KubernetesClient client = new KubernetesClientBuilder().build();
        System.out.println(client.getMasterUrl());
        NamespaceList myNs = client.namespaces().list();
        for (Namespace ns : myNs.getItems()) {
            System.out.println(ns.getMetadata().getName());
        }
        client.close();
    }
}

The master URL is taken from the server field of the kubeconfig file.

Using ServiceAccount to connect to the cluster

Usage scenario

Applicable when the application runs inside a Kubernetes cluster and can create ServiceAccounts and perform RBAC authorizations.

Create ServiceAccount and RBAC resources

apiVersion: v1
kind: ServiceAccount
metadata:
  name: fmuser
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: fmuser-role
rules:
- apiGroups: [""]
  resources: ["pods","namespaces"]
  verbs: ["get","list","watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get","list","watch"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["delete"]
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get","list","watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: fmuser-rolebinding
subjects:
- kind: ServiceAccount
  name: fmuser
  namespace: default
roleRef:
  kind: ClusterRole
  name: fmuser-role
  apiGroup: rbac.authorization.k8s.io

The client automatically reads the ServiceAccount token and CA certificate from /var/run/secrets/kubernetes.io/serviceaccount/ (files ca.crt and token).

Environment variables for external verification

KUBERNETES_MASTER=https://191.168.7.132:6443;
KUBERNETES_AUTH_SERVICEACCOUNT_TOKEN=/opt/file/serviceaccount-token;
KUBERNETES_CERTS_CA_FILE=/opt/file/serviceaccount-ca.key;
KUBERNETES_AUTH_TRYKUBECONFIG=false

Example code

import io.fabric8.kubernetes.api.model.Namespace;
import io.fabric8.kubernetes.api.model.NamespaceList;
import io.fabric8.kubernetes.client.KubernetesClient;
import io.fabric8.kubernetes.client.KubernetesClientBuilder;

public class K8sClientWithServiceAccount {
    public static void main(String[] args) {
        KubernetesClient client = new KubernetesClientBuilder().build();
        System.out.println(client.getConfiguration().getCaCertFile());
        System.out.println(client.getConfiguration().getMasterUrl());
        System.out.println(client.getConfiguration().getAutoOAuthToken());
        NamespaceList myNs = client.namespaces().list();
        for (Namespace ns : myNs.getItems()) {
            System.out.println(ns.getMetadata().getName());
        }
        client.close();
    }
}

The printed values correspond to the environment variables set above.