mydockergit

package main

import (
	"fmt"
	"net/http"
	"sort"
	"time"
)

// a struct to hold the result from each request including an index

mydockergit

Accessing Kubelet API

curl -sk https://localhost:10250/pods/

• If --anonymous-auth is turned off, you will see a 401 Unauthorized response.
• If --anonymous-auth is true and --authorization-mode is Webhook you'll see 403 Forbidden response with message Forbidden (user=system:anonymous, verb=get, resource=nodes, subresource=proxy)
• If --anonymous-auth is true and --authorization-mode is AlwaysAllow you'll see a list of pods.

mydockergit

package main

import (
	"fmt"
	"net/http"
	"sort"
	"time"
)

// a struct to hold the result from each request including an index

mydockergit

# Check rolebindings with service accounts and roles without namespaces

kubectl create ns ns1
kubectl create ns ns2
kubectl create sa sa1 -n ns1
kubectl create sa sa2 -n ns2

kubectl create role role-ns1 --verb=list,get --resource=pods -n ns1
kubectl create role role-ns2 --verb=list,get --resource=secrets -n ns2