magmalake k8s

k8s · API

k8s.config

Where the API server is and how to authenticate to it.

var cfg = Config.load()               # in a pod, its service account; else the kubeconfig
var cfg = Config.in_cluster()
var cfg = Config.from_kubeconfig()    # $KUBECONFIG or ~/.kube/config, its current context
var cfg = Config.from_kubeconfig(path, context="kind-orca")

In a pod, Kubernetes mounts the service account's token, the cluster's CA certificate and the pod's namespace under /var/run/secrets/kubernetes.io/serviceaccount/, and sets KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT. The token is read again for every request, since the kubelet rotates it.

From a kubeconfig, the context names a cluster (its server and CA) and a user: a client certificate and key (what kind writes), or a token or token file. Certificates and keys given inline (*-data, base64) are written to files in a fresh directory only this user can read (mkdtemp), as TLS takes them by path. Authentication by exec or an auth-provider (cloud CLIs) isn't supported: run the command and pass its token instead.

Structs

Config

struct Config

Implements Copyable, Movable

Fields
server: String: The API server's base URL, https://host:port.
ca_file: String: A PEM bundle the server's certificate must chain to; empty for the system's.
cert_file: String: A PEM client certificate, or empty.
key_file: String
token: String: A bearer token, or empty.
token_file: String: A file the token is read from for every request, or empty.
namespace: String: The namespace a context or pod is in; default if none is said.

__init__

def __init__(out self, server: String, ca_file: String = "", cert_file: String = "", key_file: String = "", token: String = "", token_file: String = "", namespace: String = "default")

bearer

def bearer(self) -> String

The token to send now: the file's, read again, or the given one.

load

def load() -> Self

In a pod, its service account's; otherwise the kubeconfig's current context.

in_cluster

def in_cluster() -> Self

from_kubeconfig

def from_kubeconfig(path: String = "", context: String = "") -> Self

The kubeconfig at path (else the first of $KUBECONFIG, else ~/.kube/config), in context (else its current context).

Functions

kubeconfig

def kubeconfig(y: Yaml, context: String = "", file: String = "") -> Config

The configuration of context (else the current one) in a kubeconfig read from file, which relative paths in it are against.

Aliases

comptime SERVICE_ACCOUNT = "/var/run/secrets/kubernetes.io/serviceaccount"