<p>I am trying to setup a websocket connection to the Kubernetes Pod Exec API, based on the suggestions given in this SO post: <a href="https://stackoverflow.com/questions/34373472/how-to-execute-command-in-a-pod-kubernetes-using-api">How to execute command in a pod (kubernetes) using API?</a>.
Here's what I have done so far -</p>

<ol>
<li>Installed Simple Web Socket Client extension in Chrome.</li>
<li>Started <code>kubectl proxy --disable-filter=true</code> to run proxy with WS connections allowed. <code>kubectl.exe</code> version is 1.8.</li>
<li>Used address <code>ws://localhost:8001/api/v1/namespaces/default/pods/nginx-3580832997-26zcn/exec?container=nginx&amp;stdin=1&amp;stdout=1&amp;stderr=1&amp;tty=1&amp;command=%2Fbin%2Fsh</code> in the Chrome extension to connect to the <code>exec</code> api.</li>
</ol>

<p>When I click connect, Chrome reports back an error with the message - </p>

<p><code>Error during WebSocket handshake: Response must not include 'Sec-WebSocket-Protocol' header if not present in request</code></p>

<p>Apparently, kubectl is sending back empty <code>Sec-WebSocket-Protocol</code> header in the response and Chrome is taking offense to that.</p>

<p>I tried changing the code of Simple Web Socket Client <code>open</code> method to send empty protocols parameter to the Websocket client creation call, like - <code>ws = new WebSocket(url, []);</code> to coax Chrome in sending empty header in request, but Chrome doesn't send empty header.</p>

<p>So what can be done to directly connect to the <code>exec</code> in Chrome?</p>

<p>This is a known issue; <a href="https://github.com/kubernetes/kubernetes/issues/25126" rel="nofollow noreferrer"><code>kubectl proxy</code> does not support websockets</a>. (You can verify this easily by starting up <code>kubectl proxy</code> and then attempting <code>kubectl --server=http://127.0.0.1:8001 exec ...</code>; you will receive the message <code>error: unable to upgrade connection: &lt;h3&gt;Unauthorized&lt;/h3&gt;</code> if the filter is enabled and <code>Error from server (BadRequest): Upgrade request required</code> if the filter is disabled).</p>

<p>The <a href="https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#so-many-proxies" rel="nofollow noreferrer">confusion</a> might come from the fact that the <code>kube-apiserver</code> proxy does support websockets, but that proxy is different from the <code>kubectl proxy</code>.</p>

<p>As I see you have 3 options now (in order of difficulty):</p>

<ul>
<li>Access <code>kube-apiserver</code> directly. You will likely need authentication that <code>kubectl proxy</code> is handling for you now</li>
<li>Use SockJS, this is what Kubernetes Dashboard does for the <a href="https://github.com/kubernetes/dashboard/pull/1939" rel="nofollow noreferrer">exec feature</a></li>
<li>Fix <a href="https://github.com/kubernetes/kubernetes/issues/25126" rel="nofollow noreferrer">#25126</a></li>
</ul>
