Any way to do a "raw" request?

[goncalo-oliveira]

Is there any way to do something similar to this?

kubectl get --raw "/apis/custom.metrics.k8s.io/v1beta1"

Haven't found a direct way of doing it and doesn't seem like there is one?

[tg123]

var client = new Kubernetes(config);
client.HttpClient.GetAsync(/apis/custom.metrics.k8s.io/v1beta)

[goncalo-oliveira]

Ah... almost ashamed I didn't see that... but I was using IKubernetes instead. Thanks for replying!

[goncalo-oliveira]

It's worth mentioning that this code by itself, although it works locally it does not work inside a cluster (actually, the above doesn't work at all, since it does not contain the BaseUri). It took me a while to figure out why and I had to dig into the code, but the reason is that the credentials are set in the HttpRequestMessage, before sending the request. Code here.

So... for the code above to work, it needs to be modified as

Kubernetes client = ...;

// we need to get the base uri, as it's not set on the HttpClient
var url = string.Concat( client.BaseUri, "apis/custom.metrics.k8s.io/v1beta" );

var httpRequest = new HttpRequestMessage( HttpMethod.Get, url );

if ( client.Credentials != null )
{
    await client.Credentials.ProcessHttpRequestAsync( httpRequest, CancellationToken.None );
}

var response = await client.HttpClient.SendAsync( httpRequest, HttpCompletionOption.ResponseHeadersRead );

Hope this can be useful to someone else...

[goncalo-oliveira]

This isn't really related to the dotnet client, but if someone knows the answer, I'd be much appreciated.

I'm getting a forbidden when attempting the raw request (when running in the cluster) and I would expect that the required permissions would be to custom.metrics.k8s.io group, but it's not, it seems. I've double checked the role binding and that the service account is used by the container. What would be the appropriate RBAC permissions for this request?

GET apis/custom.metrics.k8s.io/v1beta1/namespaces/{ns}/services/{svc}/{metric}

Here's the role.yaml I'm using

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: the-thing
rules:
  - apiGroups:
      - apps
    resources:
      - deployments
    verbs: ["get", "list", "patch", "watch"]
  - apiGroups:
      - ""
    resources:
      - endpoints
      - namespaces
      - pods
      - services
    verbs: ["get", "list"]
  - apiGroups:
      - custom.metrics.k8s.io
    resources:
      - "*"
    verbs: ["get", "list"]

Any help would be appreciated.

[goncalo-oliveira]

Erm... Answering my own question here... apologies... I need to be using a ClusterRole here instead. Apologies... it was one of those things where you find the answer after you explain the problem to "someone" else...