<p>How to access Kubernetes worker node labels from the container/pod running in the cluster?
Labels are set on the worker node as the yaml output of this kubectl command launched against this Azure AKS worker node shows :</p>
<pre><code>$ kubectl get nodes aks-agentpool-39829229-vmss000000 -o yaml
apiVersion: v1
kind: Node
metadata:
  annotations:
    node.alpha.kubernetes.io/ttl: &quot;0&quot;
    volumes.kubernetes.io/controller-managed-attach-detach: &quot;true&quot;
  creationTimestamp: &quot;2021-10-15T16:09:20Z&quot;
  labels:
    agentpool: agentpool
    beta.kubernetes.io/arch: amd64
    beta.kubernetes.io/instance-type: Standard_DS2_v2
    beta.kubernetes.io/os: linux
    failure-domain.beta.kubernetes.io/region: eastus
    failure-domain.beta.kubernetes.io/zone: eastus-1
    kubernetes.azure.com/agentpool: agentpool
    kubernetes.azure.com/cluster: xxxx
    kubernetes.azure.com/mode: system
    kubernetes.azure.com/node-image-version: AKSUbuntu-1804gen2containerd-2021.10.02
    kubernetes.azure.com/os-sku: Ubuntu
    kubernetes.azure.com/role: agent
    kubernetes.azure.com/storageprofile: managed
    kubernetes.azure.com/storagetier: Premium_LRS
    kubernetes.io/arch: amd64
    kubernetes.io/hostname: aks-agentpool-39829229-vmss000000
    kubernetes.io/os: linux
    kubernetes.io/role: agent
    node-role.kubernetes.io/agent: &quot;&quot;
    node.kubernetes.io/instance-type: Standard_DS2_v2
    storageprofile: managed
    storagetier: Premium_LRS
    topology.kubernetes.io/region: eastus
    topology.kubernetes.io/zone: eastus-1
  name: aks-agentpool-39829229-vmss000000
  resourceVersion: &quot;233717&quot;
  selfLink: /api/v1/nodes/aks-agentpool-39829229-vmss000000
  uid: 0241eb22-4d1b-4d65-870f-fcc51dac1c70
</code></pre>
<p>Note: The pod/Container that I have is running with non-root access and it doesn't have a privileged user.</p>
<p>Is there a way to access these labels from the worker node itself ?</p>

user3435964
<p>In the AKS cluster,</p>
<ol>
<li><p>Create a namespace like:</p>
<pre><code>kubectl create ns get-labels
</code></pre>
</li>
<li><p>Create a Service Account in the namespace like:</p>
<pre><code>kubectl create sa get-labels -n get-labels 
</code></pre>
</li>
<li><p>Create a Clusterrole like:</p>
<pre><code>kubectl create clusterrole get-labels-clusterrole --resource=nodes --verb=get,list
</code></pre>
</li>
<li><p>Create a Rolebinding like:</p>
<pre><code>kubectl create clusterrolebinding get-labels-rolebinding -n get-labels --clusterrole get-labels-clusterrole --serviceaccount get-labels:get-labels
</code></pre>
</li>
<li><p>Run a pod in the namespace you craeted like:</p>
<pre><code>cat &lt;&lt; EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: get-labels
  namespace: get-labels
spec:
  serviceAccountName: get-labels
  containers:
  - image: centos:7
    name: get-labels
    command:
    - /bin/bash
    - -c
    - tail -f /dev/null
EOF
</code></pre>
</li>
<li><p>Execute a shell in the running container like:</p>
<pre><code>kubectl exec -it get-labels -n get-labels -- bash
</code></pre>
</li>
<li><p>Install <a href="https://stedolan.github.io/jq/" rel="nofollow noreferrer"><code>jq</code></a> tool in the container:</p>
<pre><code>yum install epel-release -y &amp;&amp; yum update -y &amp;&amp; yum install jq -y
</code></pre>
</li>
<li><p>Set up shell variables:</p>
<pre><code># API Server Address
APISERVER=https://kubernetes.default.svc
# Path to ServiceAccount token
SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount
# Read this Pod's namespace
NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace)
# Read the ServiceAccount bearer token
TOKEN=$(cat ${SERVICEACCOUNT}/token)
# Reference the internal certificate authority (CA)
CACERT=${SERVICEACCOUNT}/ca.crt
</code></pre>
</li>
<li><p>If you want to get a list of all nodes and their corresponding labels, then use the following command:</p>
<pre><code>curl --cacert ${CACERT} --header &quot;Authorization: Bearer ${TOKEN}&quot; -X GET ${APISERVER}/api/v1/nodes | jq '.items[].metadata | {name,labels}'
</code></pre>
<p>else, if you want the labels corresponding to a particular node then use:</p>
<pre><code>curl --cacert ${CACERT} --header &quot;Authorization: Bearer ${TOKEN}&quot; -X GET ${APISERVER}/api/v1/nodes/&lt;nodename&gt; | jq '.metadata.labels'
</code></pre>
</li>
</ol>
<p>Please replace <code>&lt;nodename&gt;</code> with the name of node intended.</p>
<p><strong>N.B.</strong> You can choose to include the installation of the <code>jq</code> tool in the <a href="https://docs.docker.com/engine/reference/builder/" rel="nofollow noreferrer">Dockerfile</a> from which your container image is built and make use of <a href="https://docs.docker.com/compose/env-file/" rel="nofollow noreferrer">environment variables</a> for the shell variables. We have used neither in this answer in order to explain the working of this method.</p>
