<p>I currently have an Airflow deployment hosted on an EKS cluster, and want it to run a report that will check the logging for another deployment and alert me if any errors have occurred.</p>
<p>Locally I'm able to run this without issue as I can just point the k8s python api to my kubeconfig, however this doesn't work once deployed as there isn't a $Home/.kube directory with the kubeconfig on the pod.</p>
<pre><code>    with client.ApiClient(config.load_kube_config(config_file=k8s_config_file)) as api_client:
        api_instance = client.CoreV1Api(api_client)
</code></pre>
<p>I've tried removing the load_kube_config command, however this just throws a connection refused error, presumably because it now doesn't know about any cluster, although it resides in one...</p>
<p>I assume putting the kubeconfig on the deployment wouldn't be a good practice.</p>
<p>How can I get airflow to use the kubeconfig of the cluster it's hosted on?
Or is there an alternative I'm missing...</p>

davo777
<p>Answering some concerns from the question:</p>
<blockquote>
<p>I've tried removing the load_kube_config command, however this just throws a connection refused error, presumably because it now doesn't know about any cluster, although it resides in one...</p>
</blockquote>
<p>To run your code inside of the cluster (from a <code>Pod</code>) you will need to switch:</p>
<ul>
<li><strong>from:</strong> <code>config.load_kube_config()</code></li>
<li><strong>to:</strong> <code>config.load_incluster_config()</code></li>
</ul>
<p>Please read below as I addressed the rest of the setup needed to run Kubernetes Python API library code inside the cluster.</p>
<hr />
<blockquote>
<p>How can I get airflow to use the kubeconfig of the cluster it's hosted on? Or is there an alternative I'm missing...</p>
</blockquote>
<p>In fact there is a solution that you are missing:</p>
<p><strong>You will need to use a <code>ServiceAccount</code> with proper <code>Roles</code> and <code>RoleBindings</code>.</strong></p>
<p>Let me explain it a bit more and add an example to follow:</p>
<hr />
<h3>Explanation:</h3>
<p>To run such setup as I described above you will need to refer to following Kubernetes docs:</p>
<ul>
<li><em><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer">Kubernetes.io: Docs: Tasks: Configure pod container: Configure service account</a></em> - for <code>ServiceAccount</code></li>
<li><em><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">Kubernetes.io: Docs: Reference: Access authn authz: RBAC</a></em> - for <code>Role</code> and <code>RoleBinding</code></li>
</ul>
<p>As stated in the official documentation:</p>
<blockquote>
<p>When you (a human) access the cluster (for example, using <code>kubectl</code>), you are authenticated by the apiserver as a particular User Account. Processes in containers inside pods can also contact the apiserver. <strong>When they do, they are authenticated as a particular Service Account (for example, default)</strong>.</p>
</blockquote>
<p>You will need to add permissions to your <code>ServiceAccount</code> with <code>Roles</code> and <code>RoleBidings</code> to allow it to query the Kubernetes API server. For example you will need to add permissions to list <code>Pods</code>.</p>
<hr />
<h3>Example:</h3>
<p>I've already answered quite lengthily a similar case on Serverfault. I encourage you to check it out:</p>
<ul>
<li><em><a href="https://serverfault.com/questions/1041268/starting-a-container-on-a-kubernetes-cluster-from-another-container/1041787#1041787">Serverfault.com: Starting a container on a Kubernetes cluster from another container</a></em></li>
</ul>
<p>I've allowed myself to copy and alter some of the parts of this answer:</p>
<blockquote>
<h3>Create a <code>ServiceAccount</code></h3>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: python-job-sa
</code></pre>
<p>This <code>ServiceAccount</code> will be used with the <code>Deployment/Pod</code> that will host your Python code.</p>
<h3>Assign specific permissions to your <code>ServiceAccount</code></h3>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: python-job-role
rules:
# This will give you access to pods
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;]
# This will give you access to pods logs
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods/log&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;]
</code></pre>
<p>This is a <code>Role</code> that allows to query the Kubernetes API for the resources like &gt; <code>Pods</code>.</p>
<h3>Bind your <code>Role</code> to a <code>ServiceAccount</code></h3>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: python-job-rolebinding
  namespace: default
subjects:
- kind: ServiceAccount
  name: python-job-sa 
  namespace: default
roleRef:
  kind: Role 
  name: python-job-role
  apiGroup: rbac.authorization.k8s.io
</code></pre>
</blockquote>
<p>After applying those rules you can use the <code>serviceAccount: python-job-sa</code> in your <code>Deployment</code> manifest (in <code>.spec.template.spec</code>) and query Kubernetes API like below:</p>
<pre class="lang-py prettyprint-override"><code>from kubernetes import client, config

config.load_incluster_config() # &lt;-- IMPORTANT
v1 = client.CoreV1Api()

print(&quot;Listing pods with their IPs:&quot;)

ret = v1.list_namespaced_pod(&quot;default&quot;)
for i in ret.items:
    print(&quot;%s\t%s\t%s&quot; % (i.status.pod_ip, i.metadata.namespace, i.metadata.name))
</code></pre>
<p>Output:</p>
<pre class="lang-sh prettyprint-override"><code>Listing pods with their IPs:
10.88.0.12  default nginx-deployment-d6bcfb88d-q8s8s
10.88.0.13  default nginx-deployment-d6bcfb88d-zbdm6
10.88.0.11  default cloud-sdk
</code></pre>
<hr />
<p>Additonal resources:</p>
<ul>
<li><em><a href="https://blog.meain.io/2019/accessing-kubernetes-api-from-pod/" rel="nofollow noreferrer">Blog.meain.io: Accessing Kubernetes API from pod</a></em></li>
</ul>
