<p>I have application with a DockerFile. This DockerFile needs to run a shell script that have curl commands and kubectl commands.</p>
<p>I have designed the dockerFile as</p>
<pre><code>FROM ubuntu:16.04

WORKDIR /build

RUN apt-get update &amp;&amp; apt-get install -y curl &amp;&amp; apt-get install -y jq
COPY ./ ./
RUN chmod +x script.sh
ENTRYPOINT [&quot;./script.sh&quot;]
</code></pre>
<p>The <code>script.sh</code> file is what contains curl commands and kubectl command.</p>
<p>If you see I have installed curl command inside the docker container using command <code>RUN apt-get update &amp;&amp; apt-get install -y curl </code></p>
<p>What do I need to do in order to run kubectl commands ? Becase when I build and the run the above image, it throws an error saying <code>kubectl: command not found</code> .</p>
<p>Can anyone help me with this ?</p>

Arjun Karnwal
<p>Instead of installing using apt-get, you can download the binary place whatever you want and use it.</p>
<p>This will give you more control under it and less chances to have problems in the future.</p>
<p>Steps on how to download it from the official repository can be fount in the <a href="https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl-on-linux" rel="nofollow noreferrer">documentation</a>.</p>
<h3>Install kubectl binary with curl on Linux<a href="https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl-binary-with-curl-on-linux" rel="nofollow noreferrer"></a></h3>
<ol>
<li><p>Download the latest release with the command:</p>
<pre><code>curl -LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl
</code></pre>
<p>To download a specific version, replace the  <code>$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)</code>  portion of the command with the specific version.</p>
<p>For example, to download version v1.18.0 on Linux, type:</p>
<pre><code>curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.18.0/bin/linux/amd64/kubectl
</code></pre>
</li>
<li><p>Make the kubectl binary executable.</p>
<pre><code>chmod +x ./kubectl
</code></pre>
</li>
<li><p>Move the binary in to your PATH.</p>
<pre><code>sudo mv ./kubectl /usr/local/bin/kubectl
</code></pre>
</li>
<li><p>Test to ensure the version you installed is up-to-date:</p>
<pre><code>kubectl version --client
</code></pre>
</li>
</ol>
<p>Considering this, you can have a Dockerfile similar to this:</p>
<pre><code>FROM debian:buster
RUN apt update &amp;&amp; \
      apt install -y curl &amp;&amp; \
      curl -LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl &amp;&amp; \
      chmod +x ./kubectl &amp;&amp; \
      mv ./kubectl /usr/local/bin/kubectl
CMD kubectl get po
</code></pre>
<p>After this we can create a pod using the following manifest:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: internal-kubectl
spec:
  containers:
    - name: internal-kubectl
      image: myrep/internal-kubectl:latest
      command: ['sh', '-c', &quot;kubectl get pod; sleep 36000&quot;]
</code></pre>
<p>Running this pod is going to give you an error and this will happen because you don't have the necessary <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">RBAC</a> rules created.</p>
<p>The way to tell Kubernetes that we want this pod to have an identity that can list the pods is through the combination of a few different resources…</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: internal-kubectl
</code></pre>
<p>The identity object that we want to assign to our pod will be a service account. But by itself it has no permissions. That’s where roles come in.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: modify-pods
rules:
  - apiGroups: [&quot;&quot;]
    resources:
      - pods
    verbs:
      - get
      - list
      - delete
</code></pre>
<p>The role above specifies that we want to be able to get, list, and delete pods. But we need a way to correlate our new service account with our new role. Role bindings are the bridges for that…</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: modify-pods-to-sa
subjects:
  - kind: ServiceAccount
    name: internal-kubectl
roleRef:
  kind: Role
  name: modify-pods
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>This role binding connects our service account to the role that has the permissions we need. Now we just have to modify our pod config to include the service account…</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: internal-kubectl
spec:
  serviceAccountName: internal-kubectl
  containers:
    - name: internal-kubectl
      image: myrep/internal-kubectl:latest
      command: ['sh', '-c', &quot;kubectl get pod; sleep 36000&quot;]
</code></pre>
<p>By specifying spec.serviceAccountName this changes us from using the default service account to our new one that has the correct permissions. Running our new pod we should see the correct output…</p>
<pre><code>$ kubectl logs internal-kubectl
NAME               READY   STATUS    RESTARTS   AGE
internal-kubectl   1/1     Running   1          5s
</code></pre>
