Aggregated Kubernetes API Endpoint

The newly introduced karmada-aggregated-apiserver component aggregates all registered clusters and allows users to access member clusters through Karmada by the proxy endpoint.

For detailed discussion topic, see here.

Here's a quick start.

Quick start

To quickly experience this feature, we experimented with karmada-apiserver certificate.

Step1: Obtain the karmada-apiserver Certificate

For Karmada deployed using hack/local-up-karmada.sh, you can directly copy it from the $HOME/.kube/ directory.

cp $HOME/.kube/karmada.config karmada-apiserver.config

Step2: Grant permission to user system:admin

system:admin is the user for karmada-apiserver certificate. We need to grant the clusters/proxy permission to it explicitly.

Apply the following yaml file:

cluster-proxy-rbac.yaml:

unfold me to see the yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-proxy-clusterrole
rules:
- apiGroups:
  - 'cluster.karmada.io'
  resources:
  - clusters/proxy
  resourceNames:
  - member1
  - member2
  - member3
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cluster-proxy-clusterrolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-proxy-clusterrole
subjects:
  - kind: User
    name: "system:admin"

kubectl --kubeconfig $HOME/.kube/karmada.config --context karmada-apiserver apply -f cluster-proxy-rbac.yaml

Step3: Access member clusters

Run the below command (replace {clustername} with your actual cluster name):

kubectl --kubeconfig karmada-apiserver.config get --raw /apis/cluster.karmada.io/v1alpha1/clusters/{clustername}/proxy/api/v1/nodes

Or append /apis/cluster.karmada.io/v1alpha1/clusters/{clustername}/proxy to the server address of karmada-apiserver.config, and then you can directly use:

kubectl --kubeconfig karmada-apiserver.config get node

Note: For a member cluster that joins Karmada in pull mode and allows only cluster-to-karmada access, we can deploy apiserver-network-proxy (ANP) to access it.