ProxyGID          *int64
}

// newK8sClient returns a Kubernetes client
func newK8sClient(conf Config) (kubernetes.Interface, error) {
	// Some config can be passed in a kubeconfig file
	kubeconfig := filepath.Join(conf.CNIAgentRunDir, constants.CNIPluginKubeconfName)

	config, err := kube.DefaultRestConfig(kubeconfig, "")
	if err != nil {
		log.Errorf("Failed setting up kubernetes client with kubeconfig %s", kubeconfig)
		return nil, err
	}

      },
      "endpoints": {
        "Kubernetes//Pod/bookinfo/reviews-v2-5b667bcbf8-q5pn2:/10.244.1.38": {
          "workloadUid": "Kubernetes//Pod/bookinfo/reviews-v2-5b667bcbf8-q5pn2",
          "service": "bookinfo/reviews.bookinfo.svc.cluster.local",
          "address": "/10.244.1.38",
          "port": {
            "9080": 9080
          }
        },

                        "metadata": {
                            "filterMetadata": {
                                "istio": {
                                    "workload": "cert-manager-istio-csr;cert-manager;;;Kubernetes"
                                }
                            }
                        },
                        "loadBalancingWeight": 1
                    }
                ],

            workload: coredns;kube-system;;;Kubernetes
    - endpoint:
        address:
          socketAddress:
            address: 10.244.0.3
            portValue: 53
        healthCheckConfig: {}
      healthStatus: HEALTHY
      loadBalancingWeight: 1
      metadata:
        filterMetadata:
          istio:
            workload: coredns;kube-system;;;Kubernetes
    loadBalancingWeight: 2
    locality: {}

  labels: {}
    # node-role.kubernetes.io/ingress: platform
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
    # kubernetes.io/ingress.allow-http: "false"
    # kubernetes.io/ingress.global-static-ip-name: ""
    # nginx.ingress.kubernetes.io/secure-backends: "true"
    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0

	return env.Get("MESOS_CONTAINER_NAME", "") != ""
}

// IsKubernetes returns true if minio is running in kubernetes.
func IsKubernetes() bool {
	// Kubernetes env used to validate if we are
	// indeed running inside a kubernetes pod
	// is KUBERNETES_SERVICE_HOST
	// https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/kubelet_pods.go#L541
	return env.Get("KUBERNETES_SERVICE_HOST", "") != ""
}

- [Kubernetes Documentation](https://kubernetes.io/docs/home/)

```mermaid
flowchart TD
    kcg["Kubernetes client-go"]
    ic["Istio kube.Client"]
    ikc["Istio kclient.Client"]
    ikrt["Istio krt.Collection"]
    ikrt--"Builds on"-->ikc--"Builds on"-->ic--"Builds on"-->kcg
```

**`kube.Client`** is a fairly light wrapper around Kubernetes clients, but offers quite a few benefits.

                                                },
                                                "istio": {
                                                    "workload": "reviews-v3;default;reviews;v3;Kubernetes"
                                                }
                                            }
                                        },
                                        "load_balancing_weight": 1

# How to secure access to MinIO on Kubernetes with TLS [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)

This document explains how to configure MinIO server with TLS certificates on Kubernetes.

## 1. Prerequisites

- Familiarity with [MinIO deployment process on Kubernetes](https://min.io/docs/minio/kubernetes/upstream/operations/installation.html).

- Kubernetes cluster with `kubectl` configured.