<p>I'm looking for a lightweight way to access the Kubernetes API from a Pod in a C# app.</p>
<p>Kubernetes docs mention two ways of <a href="https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod" rel="nofollow noreferrer">accessing the API from a Pod</a>:</p>
<blockquote>
<ol>
<li>Run kubectl proxy in a sidecar container in the pod, or as a background process within the container</li>
</ol>
</blockquote>
<p>This generally works, and allows for easily hitting an API endpoint with just a line of code or two - example:</p>
<pre><code>using System;
using System.Net;

namespace GetIngresses
{
    class Program
    {
        static void Main(string[] args)
        {
            var apiBaseUrl = &quot;http://127.0.0.1:8001&quot;; // requires kubectl proxy
            Console.WriteLine((new WebClient()).
             DownloadString($&quot;{apiBaseUrl}/apis/networking.k8s.io/v1/ingresses&quot;));
        }
    }
}
</code></pre>
<p>However, now there's a running <code>kubectl proxy</code> process to monitor, maintain etc. - this doesn't seem ideal for production.</p>
<blockquote>
<ol start="2">
<li>Use the Go client library, and create a client using the rest.InClusterConfig() and kubernetes.NewForConfig() functions. They handle locating and authenticating to the apiserver.</li>
</ol>
</blockquote>
<p>My app is written in C#, not Go. There's a <a href="https://github.com/kubernetes-client/csharp" rel="nofollow noreferrer">C# client library</a> which presumably might be able to achieve the same thing. But do I really have to bring a whole client library on board just for a simple GET to a single endpoint?</p>
<p>Ideally, I'd like to just use <code>WebClient</code>, like in the example above. Documentation mentions that</p>
<blockquote>
<p>The recommended way to locate the apiserver within the pod is with the kubernetes.default.svc DNS name, which resolves to a Service IP which in turn will be routed to an apiserver.</p>
</blockquote>
<p>So, in the example above, can I just do this...</p>
<pre><code>var apiBaseUrl = &quot;http://kubernetes.default.svc&quot;
</code></pre>
<p>... and get <code>WebClient</code> to pass the required service account credentials? If yes, how?</p>

<blockquote>
<p>Ideally, I'd like to just use WebClient</p>
</blockquote>
<p>The Kubernetes is a REST API, so this would work. As shown on <a href="https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#using-kubectl-proxy" rel="nofollow noreferrer">Directly accessing the REST API using kubectl proxy</a> it is easy to explore the API using e.g. <code>curl</code>.</p>
<p>Example with <code>curl</code> and <code>kubectl proxy</code> - response is in json format.</p>
<pre><code>curl http://localhost:8080/api/v1/pods
</code></pre>
<p>The complicating factor is that you probably need a private certificate bundle, and it is good practice to properly validate this for security reasons. When <a href="https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#directly-accessing-the-rest-api-1" rel="nofollow noreferrer">accessing</a> the API from a Pod, the client certificate is located on <code>/var/run/secrets/kubernetes.io/serviceaccount/ca.crt</code> and in addition, you need to authenticate using the token located on <code>/var/run/secrets/kubernetes.io/serviceaccount/token</code></p>
<blockquote>
<p>But do I really have to bring a whole client library on board just for a simple GET to a single endpoint?</p>
</blockquote>
<p>What you get from a client library is:</p>
<ul>
<li>Implemented authentication using certificates and tokens</li>
<li>Typed client access - instead of hand code urls and requests</li>
</ul>
<p>The <a href="https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#dotnet-client" rel="nofollow noreferrer">dotnet-client</a> example shows how the &quot;Typed client access&quot; looks like, for &quot;listing Pods in the default namespace&quot; (see <a href="https://github.com/kubernetes-client/csharp#creating-the-client" rel="nofollow noreferrer">authentication alternatives</a>):</p>
<pre><code>var config = KubernetesClientConfiguration.InClusterConfig()  // auth from Pod
IKubernetes client = new Kubernetes(config);
Console.WriteLine(&quot;Starting Request!&quot;);

var list = client.ListNamespacedPod(&quot;default&quot;);
foreach (var item in list.Items)
{
    Console.WriteLine(item.Metadata.Name);
}
</code></pre>
