<p>Team,
I am running kubectl from my laptop and captured Wireshark trace of the same. how could I decrypt the traffic hitting the api server?</p>

<p>ex: we decrypt the http calls using private key of the web server. in k8s world, how would I decrypt the calls to cluster? new to this so need to understand. </p>

<p>The traffic itself and the (api)server keys will not be enough for that. Current TLS implementation is using <a href="https://en.m.wikipedia.org/wiki/Forward_secrecy" rel="nofollow noreferrer">forward secrecy</a> so you would need the session keys as well. Browsers can be configured to log session keys (which you can feed into wireshark) but I don't know if kubectl can be configured with some debugging options to do that. Probably not.</p>

<p>An alternative is a <a href="https://en.m.wikipedia.org/wiki/Man-in-the-middle_attack" rel="nofollow noreferrer">man in the middle "attack"</a> which will defeat TLS with forward secrecy. I capture kubectl traffic with <a href="https://github.com/mitmproxy/mitmproxy" rel="nofollow noreferrer">mitmproxy</a>. You will need to set it up with kubernetes CA, so the generated certificates are valid as far as kubectl is concerned.</p>

<p><em>Of course, all for educational purposes at trainings ;-)</em></p>
