<p>While using <code>Kubernetes API</code>, I came across this issue where I am not able to <code>pod exec</code> into another pod using the API.</p>
<p>I made sure I am running a <code>pod</code> with a <code>serviceAccount</code> that has correct <code>RBAC</code> permissions (and both <code>pods</code> are in the same namespace). I tried with <code>curl</code> (<code>7.74.0</code>) but I stumbled upon <a href="https://stackoverflow.com/a/49254652/1722326">this</a> SO answer that <code>curl</code> may not be the right utility to do this. I have already tried other possible options (<a href="https://github.com/kubernetes-client/python/issues/409#issuecomment-1241425302" rel="nofollow noreferrer">this</a> and <a href="https://stackoverflow.com/a/37396806/1722326">this</a>) mentioned in the comments in the same post, but no luck.</p>
<pre><code>TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)    

curl -k -H &quot;Upgrade: SPDY/3.1&quot; -H &quot;Authorization: Bearer $TOKEN&quot; -H &quot;Connection: Upgrade&quot; -H &quot;Sec-WebSocket-Version: 13&quot; -H &quot;Accept: application/json&quot; &quot;https://kuberne
    tes.default.svc/api/v1/namespaces/$NAMESPACE/pods/nginx-deployment-5c547569b4-jgm85/exec?command=ls&quot;
    {
      &quot;kind&quot;: &quot;Status&quot;,
      &quot;apiVersion&quot;: &quot;v1&quot;,
      &quot;metadata&quot;: {},
      &quot;status&quot;: &quot;Failure&quot;,
      &quot;message&quot;: &quot;Upgrade request required&quot;,
      &quot;reason&quot;: &quot;BadRequest&quot;,
      &quot;code&quot;: 400
    }
</code></pre>
<p>Have already tried adding/removing few of those headers.</p>
<p>The next thing I tried was <code>wscat</code> (<code>5.2.0</code>). Tried a couple of variations, but needless to say, &quot;no luck&quot; again.</p>
<pre><code>wscat -n -H &quot;Authorization: Bearer $TOKEN&quot; -c wss://kubernetes.default.svc/api/v1/namespaces/$NAMESPACE/pods/nginx-deployment-5c547569b4-jgm85/exec?command=ls

error: Unexpected server response: 403
</code></pre>
<p>This command outputs nothing (at all):</p>
<pre><code>wscat -c wss://kubernetes.default.svc/api/v1/namespaces/$NAMESPACE/pods/nginx-deployment-5c547569b4-jgm85/exec?command=ls&amp;stdin=true&amp;stdout=true&amp;tty=true&amp;token=$TOKEN&amp;namespace=$NAMESPACE 
</code></pre>
<p>I looked at <a href="https://stackoverflow.com/a/64316721/1722326">this</a> SO post, but it doesn't work for me.</p>
<pre><code>wscat  -n -H &quot;Authorization: Bearer $TOKEN&quot; -c 'https://kubernetes.default.svc/api/v1/namespaces/$NAMESPACE/pods/nginx-deployment-5c547569b4-jgm85/exec?command=ls&amp;stdin=true&amp;stdout=true&amp;tty=true'

...
SyntaxError: The URL's protocol must be one of &quot;ws:&quot;, &quot;wss:&quot;, or &quot;ws+unix:&quot;
...
</code></pre>
<p>Not sure how the fella even managed to use <code>http(s)</code> in the first place.</p>
<p>Can someone kindly advise if there's something wrong with what I doing or an alternative (can't use <code>kubectl</code>) to do the same? TIA</p>

<p>Curl Magic and trial and error.
Make sure that the user has the right permissions so you don't get the 403.</p>
<pre><code>curl -k \
  --http1.1 \
  -H &quot;Sec-WebSocket-Key: SGVsbG8sIHdvcmxkIQ==&quot; \
  -H &quot;Sec-WebSocket-Version: 13&quot; \
  -i \
  -N \
  -L \
  -k \
  -H &quot;Connection: Upgrade&quot; \
  -H &quot;Upgrade: websocket&quot; \
  -H &quot;Authorization: Bearer $TOKEN&quot; \
  &quot;https://127.0.0.1:53329/api/v1/namespaces/default/pods/single-wrong-arch/exec?command=ls&amp;command=-l&amp;stdin=true&amp;stdout=true&amp;stderr=true&quot;

HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: qGEgH3En71di5rrssAZTmtRTyFk=
Sec-WebSocket-Protocol:


total 56
~drwxr-xr-x    2 root     root          4096 Mar 29 14:45 bin
drwxr-xr-x    5 root     root           360 Apr 27 11:03 dev
drwxr-xr-x    1 root     root          4096 Apr 27 11:03 etc
drwxr-xr-x    2 root     root          4096 Mar 29 14:45 home
drwxr-xr-x    7 root     root          4096 Mar 29 14:45 lib
drwxr-xr-x    5 root     root          4096 Mar 29 14:45 media
drwxr-xr-x    2 root     root          4096 Mar 29 14:45 mnt
drwxr-xr-x    2 root     root          4096 Mar 29 14:45 opt
dr-xr-xr-x  248 root     root             0 Apr 27 11:03 proc
drwx------    2 root     root          4096 Mar 29 14:45 root
drwxr-xr-x    1 root     root          4096 Apr 27 11:03 run
drwxr-xr-x    2 root     root          4096 Mar 29 14:45 sbin
drwxr-xr-x    2 root     root          4096 Mar 29 14:45 srv
dr-xr-xr-x   13 root     root             0 Apr 27 11:03 sys
drwxrwxrwt    2 root     root          4096 Mar 29 14:45 tmp
drwxr-xr-x    7 root     root          4096 Mar 29 14:45 usr
drwxr-xr-x   12 root     root          4096 Mar 29 14:45 var

</code></pre>
<p>That's against a minikube cluster, which should explain the port choice and here's the rest of the environemt:</p>
<pre><code>$ curl --version
curl 7.87.0 (x86_64-apple-darwin22.0) libcurl/7.87.0 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.11 nghttp2/1.51.0
Release-Date: 2022-12-21
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz MultiSSL NTLM NTLM_WB SPNEGO SSL threadsafe UnixSockets

$ minikube version
minikube version: v1.30.1
commit: 08896fd1dc362c097c925146c4a0d0dac715ace0

$ kubectl version
WARNING: This version information is deprecated and will be replaced with the output from kubectl version --short.  Use --output=yaml|json to get the full version.
Client Version: version.Info{Major:&quot;1&quot;, Minor:&quot;27&quot;, GitVersion:&quot;v1.27.0&quot;, GitCommit:&quot;1b4df30b3cdfeaba6024e81e559a6cd09a089d65&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2023-04-11T17:04:23Z&quot;, GoVersion:&quot;go1.20.3&quot;, Compiler:&quot;gc&quot;, Platform:&quot;darwin/arm64&quot;}
Kustomize Version: v5.0.1
Server Version: version.Info{Major:&quot;1&quot;, Minor:&quot;26&quot;, GitVersion:&quot;v1.26.3&quot;, GitCommit:&quot;9e644106593f3f4aa98f8a84b23db5fa378900bd&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2023-03-15T13:33:12Z&quot;, GoVersion:&quot;go1.19.7&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/arm64&quot;}

$ uname -a
Darwin 22.4.0 Darwin Kernel Version 22.4.0: Mon Mar  6 21:00:41 PST 2023; root:xnu-8796.101.5~3/RELEASE_ARM64_T8103 arm64


</code></pre>
