<p>You can simply interact with K8s using its REST API. For example to get pods:</p>
<pre><code>curl http://IPADDR/api/v1/pods
</code></pre>
<p>However I can't find any example of authentication based only on curl or REST. All the examples show the usage of <code>kubectl</code> as proxy or as a way to get credentials.</p>
<p>If I already own the <code>.kubeconfig</code>, and nothing else, is there any way to send the HTTP requests directly (e.g. with a token) without using <code>kubectl</code>?</p>

collimarco
<p>The <code>kubeconfig</code> file you download when you first install the cluster includes a client certificate and key. For example:</p>
<pre><code>clusters:
- cluster:
    certificate-authority-data: ...
    server: https://api.cluster1.ocp.virt:6443
  name: cluster1
contexts:
- context:
    cluster: cluster1
    user: admin
  name: admin
current-context: admin
preferences: {}
users:
- name: admin
  user:
    client-certificate-data: ...
    client-key-data: ...
</code></pre>
<p>If you extract the <code>client-certificate-data</code> and <code>client-key-data</code> to
files, you can use them to authenticate with curl. To extract the
data:</p>
<pre><code>$ yq  -r '.users[0].user.&quot;client-certificate-data&quot;'  kubeconfig | base64 -d &gt; cert
$ yq  -r '.users[0].user.&quot;client-key-data&quot;'  kubeconfig | base64 -d &gt;
key
</code></pre>
<p>And then using <code>curl</code>:</p>
<pre><code>$ curl -k --cert cert --key key \
  'https://api.cluster1.ocp.virt:6443/api/v1/namespaces/default/pods?limit=500'
{
  &quot;kind&quot;: &quot;PodList&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {
    &quot;resourceVersion&quot;: &quot;22022&quot;
  },
  &quot;items&quot;: []
</code></pre>
<hr />
<p>Alternately, if your <code>.kubeconfig</code> has tokens in it, like this:</p>
<pre><code>[...]
users:
- name: your_username/api-clustername-domain:6443
  user:
    token: sha256~...
</code></pre>
<p>Then you can use that token as a bearer token:</p>
<pre><code>$ curl -k https://api.mycluster.mydomain:6443/ -H 'Authorization: Bearer sha256~...'
</code></pre>
<p>...but note that those tokens typically expire after some time, while the certificates should work indefinitely (unless they are revoked somehow).</p>
