<p>The examples in the k8s java client all use default client, see <a href="https://github.com/kubernetes-client/java/tree/client-java-parent-2.0.0/examples/src/main/java/io/kubernetes/client/examples" rel="nofollow noreferrer">here</a>. </p>

<pre><code>ApiClient client = Config.defaultClient();
Configuration.setDefaultApiClient(client);
</code></pre>

<p>How I can config k8s client so that it can talk to k8s CRDs (say, sparkoperator) from a k8s cluster pod? How should I config this client? (basePath, authentications?) And what is the basePath I should use within a pod in the same k8s cluster?</p>

<p>You can use the <code>defaultClient</code> for that as well. </p>

<p>The <code>defaultClient()</code> method will create a in-cluster client if the application is running inside the cluster and has the correct service account.</p>

<p>You can see the rules for <code>defaultClient</code> from  comments on the method <a href="https://github.com/kubernetes-client/java/blob/client-java-parent-2.0.0/util/src/main/java/io/kubernetes/client/util/Config.java#L91" rel="nofollow noreferrer">here</a>: </p>

<pre class="lang-java prettyprint-override"><code>/**
   * Easy client creation, follows this plan
   *
   * &lt;ul&gt;
   *   &lt;li&gt;If $KUBECONFIG is defined, use that config file.
   *   &lt;li&gt;If $HOME/.kube/config can be found, use that.
   *   &lt;li&gt;If the in-cluster service account can be found, assume in cluster config.
   *   &lt;li&gt;Default to localhost:8080 as a last resort.
   * &lt;/ul&gt;
   *
   * @return The best APIClient given the previously described rules
   */
</code></pre>

<p>So if the application using the k8s java client, run on the cluster it self, it should be able to access stuff on the cluster as long as it has correct permission. 
You need to allow your client application to be able to access the CRDs, like this example of <code>ClusterRole</code> for <a href="https://github.com/coreos/prometheus-operator/blob/master/Documentation/rbac-crd.md" rel="nofollow noreferrer">CRDs of Prometheus Operator</a>:</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: prometheus-crd-view
  labels:
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-view: "true"
rules:
- apiGroups: ["monitoring.coreos.com"]
  resources: ["alertmanagers", "prometheuses", "prometheusrules", "servicemonitors"]
  verbs: ["get", "list", "watch"]
</code></pre>
