<p>I have a container where I used a bitnami/kubectl image.<br />
Now I want to run a few kubectl commands inside that container.</p>
<p>How kubectl container aware of my kubeconfig file?<br />
I know that I can mount the local kubeconfig file into containers and use it.</p>
<p>But is there any other way possible to access kubeconfig without using it as a volume mount?</p>
<p>I went throug the documentation of RBAC in Kubernetes.<br />
Does configure role and role-binding alone is enough to run kubectl apply and kubectl delete commands successfully even without mounting kubeconfig file?</p>
<p>It would be really helpful if someone helps me with this.<br />
Thanks in advance!</p>

anonymous user
<blockquote>
<p>Now I want to run a few kubectl commands inside that container.</p>
</blockquote>
<ul>
<li>Why do you need it inside the container?</li>
</ul>
<p><code>kubectl</code> is your CLI to &quot;communicate&quot; with the cluster, the commands are passed to the <code>kube-api</code>, parsed, and executed usually by <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/" rel="nofollow noreferrer"><code>Admission controller</code></a>.</p>
<p>Not clear why you need to run kubectl commands inside the container, since <code>kubectl</code> use your <code>kubeconfig</code> file for the communication (it will read the certificate path to the certificate data) and will be able to connect to your cluster.</p>
<hr />
<h3>How to run K8S API in your container?</h3>
<ul>
<li><p>The appropriate solution is to run an API query inside your container.</p>
</li>
<li><p>Every pod stores internally the <code>Token</code> &amp; <code>ServiceAccount</code> which will allow you to query the API</p>
</li>
<li><p>Use the following script I'm using to query the API
<a href="https://github.com/nirgeier/KubernetesLabs/blob/master/Labs/21-KubeAPI/api_query.sh" rel="nofollow noreferrer">https://github.com/nirgeier/KubernetesLabs/blob/master/Labs/21-KubeAPI/api_query.sh</a></p>
</li>
</ul>
<pre class="lang-bash prettyprint-override"><code>  #!/bin/sh

  #################################
  ## Access the internal K8S API ##
  #################################
  # Point to the internal API server hostname
  API_SERVER_URL=https://kubernetes.default.svc

  # Path to ServiceAccount token
  # The service account is mapped by the K8S API server in the pods
  SERVICE_ACCOUNT_FOLDER=/var/run/secrets/kubernetes.io/serviceaccount

  # Read this Pod's namespace if required
  # NAMESPACE=$(cat ${SERVICE_ACCOUNT_FOLDER}/namespace)

  # Read the ServiceAccount bearer token
  TOKEN=$(cat ${SERVICE_ACCOUNT_FOLDER}/token)

  # Reference the internal certificate authority (CA)
  CACERT=${SERVICE_ACCOUNT_FOLDER}/ca.crt

  # Explore the API with TOKEN and the Certificate
  curl -X GET \
       --cacert ${CACERT} \
       --header &quot;Authorization: Bearer ${TOKEN}&quot; \
       ${API_SERVER_URL}/api
</code></pre>
