Authenticate to the Kubernetes API server from inside a Pod using the projected ServiceAccount token

Documented steps

1. Build the API server URL from the injected env vars: https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT_HTTPS. The in-cluster address is also published as the 'kubernetes' Service in the 'default' namespace, reachable as the DNS name kubernetes.default.svc.
2. Read the bearer token from /var/run/secrets/kubernetes.io/serviceaccount/token (mounted into every container of the Pod by default).
3. Read the CA bundle from /var/run/secrets/kubernetes.io/serviceaccount/ca.crt and use it to verify the API server's serving certificate. Never disable TLS verification.
4. Read the Pod's own namespace from /var/run/secrets/kubernetes.io/serviceaccount/namespace — use it as the default namespace for namespaced API calls.
5. Send requests with the header 'Authorization: Bearer <token>'. Official verified example: curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api
6. Confirm connectivity by GETting /api — a healthy response is a JSON APIVersions object: {"kind":"APIVersions","versions":["v1"],"serverAddressByClientCIDRs":[...]}.
7. Enumerate available API groups with GET /apis (APIGroupList) and a specific group's resources with GET /apis/{group}/{version} (APIResourceList) before assuming an endpoint exists.
8. For out-of-cluster callers, mint a short-lived ServiceAccount token instead of hardcoding a Secret: 'kubectl create token <serviceaccount> [--duration=...]' returns a time-bound token usable in the same Bearer header.
9. Prefer an official client library (Go rest.InClusterConfig(), Python config.load_incluster_config()) when available — they handle host discovery, token reload, and CA setup automatically.
10. Docs: https://kubernetes.io/docs/tasks/run-application/access-api-from-pod/ and https://kubernetes.io/docs/reference/access-authn-authz/authentication/