<p>I've got no access to kube-apiserver pod directly, but I do have an access to kube-proxy pod. Can I run <code>curl https://localhost:6443/healthz</code> as a healthness probe to <code>kube-apiserver</code> or something?</p>

Alex Ivanov
<p>All the Pods can have access to the API Server: this is granted by the Service Account secret mounted in <code>/var/run/secrets/kubernetes.io/serviceaccount/token</code>.</p>
<blockquote>
<p>Before proceeding, you have to ensure your Pod is allowed to reach the API Server, thus not blocked by a NetworkPolicy: this requirement hasn't been declared on your question, so giving this is not the case.</p>
</blockquote>
<p>The said token is used to performs actions against the API Server, such as CRUD ops for those resources protected by RBAC.</p>
<p>If you just need to check the healthiness of the API Server, you can cURL the API Server using the mounted CA public certificate in <code>/var/run/secrets/kubernetes.io/serviceaccount/ca.pem</code> and the environment variable <code>KUBERNETES_SERVICE_HOST</code> already injected at runtime in your Pod pointing to the API Server, as well with the <code>KUBERNETES_SERVICE_PORT</code> although the 443 should be the default value.</p>
<h2>Example</h2>
<pre><code># kubectl run -it --image curlimages/curl curl --command -- sh
If you don't see a command prompt, try pressing enter.
/ $ env | grep -i kubernetes
KUBERNETES_SERVICE_PORT=443
KUBERNETES_PORT=tcp://10.96.0.1:443
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_SERVICE_PORT_HTTPS=443
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
KUBERNETES_SERVICE_HOST=10.96.0.1
/ $ curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT/api 
-H &quot;Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)&quot;
{
  &quot;kind&quot;: &quot;APIVersions&quot;,
  &quot;versions&quot;: [
    &quot;v1&quot;
  ],
  &quot;serverAddressByClientCIDRs&quot;: [
    {
      &quot;clientCIDR&quot;: &quot;0.0.0.0/0&quot;,
      &quot;serverAddress&quot;: &quot;172.20.0.2:6443&quot;
    }
  ]
}
</code></pre>
