Is API access enabled by default on Tanzu Community Edition?

[smitchell]

Do I have to do anything to enable API access on TCE? I am running the latest TCE on my Mac. Kubectl works fine, and I can get to my cluster info, but I can't call the API. When I issue this command, it hangs:

curl -s https://172.18.0.4:6443 -k

I also followed this article on CURLing the K8S API, but those API calls hang too. Here is an example:

curl -s $APISERVER/api/v1/namespaces/default/pods/ --header "Authorization: Bearer $TOKEN" --cacert /tmp/ca.crt

Is this user error?

[joshrosso]

Hi @smitchell!

It's likely you're reaching out to the wrong address.

A cool trick you can use is run:

kubectl get pod -v6

This will give you insight into the IP and URL that kubectl is calling. In my case, it is:

I0121 10:55:59.173041 2644624 loader.go:372] Config loaded from file:  /home/josh/.kube/config
I0121 10:55:59.185370 2644624 round_trippers.go:553] GET https://127.0.0.1:33865/api/v1/namespaces/default/pods?limit=500 200 OK in 5 milliseconds
No resources found in default namespace.

Taking the above, you can run curl:

curl -k https://127.0.0.1:33865/api/v1/namespaces/default/pods?limit=500

resulting in:

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "pods is forbidden: User \"system:anonymous\" cannot list resource \"pods\" in API group \"\" in the namespace \"default\"",
  "reason": "Forbidden",
  "details": {
    "kind": "pods"
  },
  "code": 403
}

[smitchell]

Thank you for the prompt response @joshrosso! kubectl get pod -v6 works as you described. It was totally on me. This is what worked for me after I RTFM.

kubectl config view -o jsonpath='{"Cluster name\tServer\n"}{range .clusters[*]}{.name}{"\t"}{.cluster.server}{"\n"}{end}'
export CLUSTER_NAME="My standalone Tanzu CE cluster name from previous command"
APISERVER=$(kubectl config view -o jsonpath="{.clusters[?(@.name==\"$CLUSTER_NAME\")].cluster.server}")
TOKEN=$(kubectl get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='default')].data.token}"|base64 --decode)
curl -X GET $APISERVER/api/v1 --header "Authorization: Bearer $TOKEN" --insecure