K3s API Access via Cloudflare Tunnel

1apiVersion: v1
2kind: ServiceAccount
3metadata:
4  name: codeforge-sa
5  namespace: codelearn
6---
7apiVersion: rbac.authorization.k8s.io/v1
8kind: Role
9metadata:
10  name: codeforge-cs-manager
11  namespace: codelearn
12rules:
13  - apiGroups: [""]
14    resources: ["pods", "services", "persistentvolumeclaims"]
15    verbs: ["get", "list", "watch", "create", "delete"]
16  - apiGroups: [""]
17    resources: ["pods/status"]
18    verbs: ["get"]
19  - apiGroups: ["networking.k8s.io"]
20    resources: ["ingresses"]
21    verbs: ["get", "list", "create", "delete"]
22---
23apiVersion: rbac.authorization.k8s.io/v1
24kind: RoleBinding
25metadata:
26  name: codeforge-cs-manager-binding
27  namespace: codelearn
28subjects:
29  - kind: ServiceAccount
30    name: codeforge-sa
31    namespace: codelearn
32roleRef:
33  kind: Role
34  name: codeforge-cs-manager
35  apiGroup: rbac.authorization.k8s.io

1kubectl -n codelearn create token codeforge-sa --duration=8760h

1apiVersion: v1
2kind: Secret
3metadata:
4  name: codeforge-sa-token
5  namespace: codelearn
6  annotations:
7    kubernetes.io/service-account.name: codeforge-sa
8type: kubernetes.io/service-account-token

1kubectl apply -f - <<EOF
2apiVersion: v1
3kind: Secret
4metadata:
5  name: codeforge-sa-token
6  namespace: codelearn
7  annotations:
8    kubernetes.io/service-account.name: codeforge-sa
9type: kubernetes.io/service-account-token
10EOF
11
12kubectl -n codelearn get secret codeforge-sa-token -o jsonpath='{.data.token}' | base64 -d

1curl -s -H "Authorization: Bearer <TOKEN>" \
2  https://k8s.tkweb.site/api/v1/namespaces/codelearn/pods | head -20