Hi all, I have a situation where I'd like to add a sidecar to the kube-apiserver and this will need to happen after the cluster has been created. Would the proper way to do this be to edit the manifest in

/var/lib/rancher/rke2/agent/pod-manifests/

or just do a

kubectl edit

on the pod itself?

the static pods are managed by RKE2. There is no way to inject additional containers into the control-plane static pods.

I have a reverse proxy that I'm trying to put right next to the kube-apiserver to allow me to use kubectl with all ports closed.

I mean you could edit the static pods but that is 1) not supported 2) going to be undone every time you restart rke2

it would still be internally accessible, would just be closing off anything from outside the cluster

ok so just run it as a pod and leave the apiserver alone

that does work, and that's what I've going at the moment, but I'd like to hit the kube-apiserver without using kubedns

the apiserver is always at the first address in the service IP range, you could rely on that fact, or use the KUBERNETES_SERVICE_HOST environment variable via downwards API… there are a lot of different ways to do what you want without having to hack at the static pod

KUBERNETES_SERVICE_HOST

would allow me to specifly directly where to send traffic from my pod?

just run

env

in a pod, look at what you see

the problem isn't necessarily DNS, more just getting traffic directly to its destination in as few steps as possible

no, that’s the address of the Kubernetes service

mmmm right right