Kubernetes Java Client

Java client for the kubernetes API.

To start using Kubernetes Java Client

See the wiki page and documentation here.

• Installation
• Client Versioning and Compatibility
• Code Examples

Exec credential plugin policy

Kubeconfig exec credential plugins start local processes. Only load trusted kubeconfigs with the default AllowAll policy. Applications can restrict which plugins may run using ExecCredentialPluginPolicy, which follows the credentialPluginPolicy / credentialPluginAllowlist semantics of kuberc:

// Deny all exec plugins
ApiClient client = ClientBuilder.standard(ExecCredentialPluginPolicy.DENY_ALL).build();

// Only allow specific plugins (basenames resolved via PATH, or full paths)
ApiClient client = ClientBuilder.standard(
    ExecCredentialPluginPolicy.allowlist("kubelogin", "/usr/local/bin/my-trusted-plugin")).build();

// Use the same policy as kubectl ($KUBERC or ~/.kube/kuberc)
ApiClient client = ClientBuilder.standard(ExecCredentialPluginPolicy.fromDefaultKubeRc()).build();

// Or on a KubeConfig loaded manually
kubeConfig.setExecCredentialPluginPolicy(ExecCredentialPluginPolicy.DENY_ALL);

An allowlist entry matches when it is exactly equal to the plugin command, or when both resolve to the same executable via PATH (symlinks and globs are not resolved). Denied plugins are never started and an ExecCredentialPluginDeniedException is thrown. The policy applies to both initial credential acquisition and token refresh. It does not restrict plugin arguments or environment, and is a defense-in-depth measure rather than a sandbox.

Release

Starting from 20.0.0 (Kubernetes 1.28), client-java-api has introduced non-backward-compatible changes. Optional parameters are now consolidated into a single object, and Java8 support has been removed. For Java8 users or those preferring the old SDK interface, a legacy SDK module version is available with a "-legacy" suffix, like 20.0.0-legacy.

Development

• Development and Contributing
• Generate Java CRD Models
• Known Issues
• Troubleshooting/FAQ

To update the Maven project version across all pom.xml files, including the optional fluent-gen module, run:

./scripts/update-version.sh 28.0.0-SNAPSHOT

The helper delegates to the Maven Versions Plugin, so the equivalent Maven command is:

./mvnw -Pfluent-gen versions:set -DnewVersion=28.0.0-SNAPSHOT -DprocessAllModules=true -DgenerateBackupPoms=false

Support

If you need support, start with checking whether you're hitting known issues. If that doesn't work, please open an issue to describe the cases. Additionally, before you file an issue, please search existing issues to see if your issue is already covered.

You can also reach out to us via #kubernetes-client slack channel.