12

I'm trying to exec kubernetes pod using the Websocket, as per the kubernetes document it can be achieved through passing the Bearer THETOKEN

When using bearer token authentication from an http client, the API server expects an Authorization header with a value of Bearer THETOKEN

Here is the sample for wscat passing Header Value --header "Authorization: Bearer $TOKEN" to establish exec to pod and the connection went successfully

/ # wscat  --header "Authorization: Bearer $TOKEN"  -c "wss://api.0cloud0.com/api/v1/namespaces/ba410a7474380169a5ae230d8e784535/pods/txaclqhshg
-6f69577c74-jxbwn/exec?stdin=1&stdout=1&stderr=1&tty=1&command=sh"

But when it comes to Websocket API connection from web browser

How to pass this Beaer Token in the web Socket as per the doc there is no standard way to pass custom header

Tried URI Query Parameter access_token= Bearer TOKEN in the API query it doesn't work and the Authentication denied with 403 

wss://api.0cloud0.com/api/v1/namespaces/ba410a7474380169a5ae230d8e784535/pods/txaclqhshg-%206f69577c74-jxbwn/exec?stdout=1&stdin=1&stderr=1&tty=1&command=%2Fbin%2Fsh&command=-i&access_token=$TOKEN
Thomas Dickey
  • 51,086
  • 7
  • 70
  • 105
anish
  • 6,884
  • 13
  • 74
  • 140
  • 2
    A question similar to this exists [is it possible to use bbearer authentication for websocket upgrade request](https://stackoverflow.com/questions/22383089/is-it-possible-to-use-bearer-authentication-for-websocket-upgrade-requests/26123316#26123316) – Daniel Karapishchenko Apr 09 '21 at 20:59
  • Does this answer your question? [How can I pod exec (and run a command) using Kubernetes API?](https://stackoverflow.com/questions/76119545/how-can-i-pod-exec-and-run-a-command-using-kubernetes-api) – Rick Rackow May 05 '23 at 08:42

1 Answers1

1

I never used websocket with kubernetes before, but here is the documentation about the token authentication method for websocket browser clients https://github.com/kubernetes/kubernetes/pull/47740

You must to send token in subprotocol parameter with the token encoded in base64.

So it should be:

wscat  -s "base64url.bearer.authorization.k8s.io.$TOKEN_IN_BASE64","base64.binary.k8s.io" -c "wss://api.0cloud0.com/api/v1/namespaces/ba410a7474380169a5ae230d8e784535/pods/txaclqhshg
-6f69577c74-jxbwn/exec?stdin=1&stdout=1&stderr=1&tty=1&command=sh"
TlmaK0
  • 3,578
  • 2
  • 31
  • 51