<p>This simple Node.js program works fine on local because it pulls the kubernetes config from my local /root/.kube/config file</p>

<pre><code>const Client = require('kubernetes-client').Client;
const Config = require('kubernetes-client/backends/request').config;

const client = new K8sClient({ config: Config.fromKubeconfig(), version: '1.13' });

const pods = await client.api.v1.namespaces('xxxxx').pods.get({ qs: { labelSelector: 'application=test' } });
console.log('Pods: ', JSON.stringify(pods));
</code></pre>

<p>Now I want to run it as a Docker container on cluster and get all current cluster's running PODs (for same/current namespace). Now of course it fails:</p>

<pre><code>Error:  { Error: ENOENT: no such file or directory, open '/root/.kube/config'
</code></pre>

<p>So how make it work when deployed as a Docker container to cluster?
This little service needs to scan all running PODs... Assume it doesn't need pull config data since it's already deployed.. So it needs to access PODs on current cluster</p>

John Glabb
<p>Couple of concepts to grab your head around first:</p>

<ul>
<li><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer">Service account</a></li>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings" rel="nofollow noreferrer">Role</a></li>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings" rel="nofollow noreferrer">Role binding</a></li>
</ul>

<p>To perform you end goal (which if i understand correct): Containerize <em>Node js</em> application</p>

<p>Step 1: Put application in a container</p>

<p>Step 2: Create a <a href="https://kubernetes.io/docs/concepts/workloads/controllers/deployment/" rel="nofollow noreferrer">deployment</a>/<a href="https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/" rel="nofollow noreferrer">statefulset</a>/<a href="https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/" rel="nofollow noreferrer">daemonset</a> as per you requirement using the container created above in step 1</p>

<p>Explanation:</p>

<p>In step 2 above {by default} if you do not (explicitly) mention a serviceaccount (custom) then it will be the <strong>default</strong> account the credentials of which are mounted inside the container (by default) here</p>

<pre><code>volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: default-token-xxxx
      readOnly: true
</code></pre>

<p>which can be verified by this command after (successful) pod creation </p>

<p><code>kubectl get pod -n {yournamespace(by default is default)} POD_NAME -o yaml</code></p>

<p>Now (Gotchas!!) if you cannot access the cluster with those credentials then depending on which service account you are using and the rights of that serviceaccount needs to be accessed. For example if you are using <em>abc</em> serviceaccount which does not have rolebinding to it then you will not be able to view the cluster. In that case you need to create (first) a role (to read pods) and a rolebinding (for that role) to the serviceaccount. </p>

<p><hr/>
<strong>UPDATE</strong>:<br/>The problem got resolved by changing <code>Config.fromKubeconfig()</code> to <code>Config.getInCluster()</code> <a href="https://github.com/godaddy/kubernetes-client/blob/master/backends/request/config.js#L33" rel="nofollow noreferrer">Ref</a><br/>
Clarification: <code>fromKubeconfig()</code> function is good if you are running your application on a node which is a part of kubernetes cluster and has cluster accessing token saved here: <code>/$USER/.kube/config</code> but if you want to run the nodeJS appilcation in a container in a pod then you need this <code>Config.getInCluster()</code> to load the token. 
if you are nosy enough then check the comments of this answer! :P</p>

<p>Note: here the nodejs library in discussion is <a href="https://github.com/godaddy/kubernetes-client/" rel="nofollow noreferrer">this</a></p>
