### Access Managed Clusters with Native Clients (Go)

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

Provides Go code examples demonstrating how to use native Kubernetes clients (kubernetes.io/client-go and controller-runtime) to interact with managed clusters. It involves wrapping the Kubernetes config with a ClusterGateway round-tripper to enable multi-cluster context switching.

```go
package main

import (
    "context"
    "fmt"

    multicluster "github.com/oam-dev/cluster-gateway/pkg/apis/cluster/transport"
    corev1 "k8s.io/api/core/v1"
    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    "k8s.io/apimachinery/pkg/types"
    "k8s.io/client-go/kubernetes"
    "k8s.io/client-go/tools/clientcmd"
    "sigs.k8s.io/controller-runtime/pkg/client"
)

func main() {
    cfg, err := clientcmd.BuildConfigFromFlags("", "/path/to/kubeconfig")
    if err != nil {
        panic(err)
    }

    // Wrap config with ClusterGateway round-tripper
    cfg.Wrap(multicluster.NewClusterGatewayRoundTripper)

    // Native Kubernetes client example
    nativeClient := kubernetes.NewForConfigOrDie(cfg)
    defaultNs, err := nativeClient.CoreV1().Namespaces().Get(
        multicluster.WithMultiClusterContext(context.TODO(), "my-managed-cluster"),
        "default",
        metav1.GetOptions{})
    if err != nil {
        panic(err)
    }
    fmt.Printf("Namespace: %s, Status: %s\n", defaultNs.Name, defaultNs.Status.Phase)

    // Controller-runtime client example
    runtimeClient, err := client.New(cfg, client.Options{})
    if err != nil {
        panic(err)
    }

    ns := &corev1.Namespace{}
    err = runtimeClient.Get(
        multicluster.WithMultiClusterContext(context.TODO(), "my-managed-cluster"),
        types.NamespacedName{Name: "kube-system"},
        ns)
    if err != nil {
        panic(err)
    }
    fmt.Printf("Found namespace: %s\n", ns.Name)
}
```

--------------------------------

### Setup KinD Cluster for Local Development

Source: https://github.com/oam-dev/cluster-gateway/blob/master/docs/local-run.md

Creates a local KinD Kubernetes cluster named 'hub', exports its kubeconfig, and loads the locally built cluster-gateway Docker image into the cluster. This prepares the environment for deploying the apiserver.

```shell
kind create cluster --name hub
kind export kubeconfig --kubeconfig /tmp/hub.kubeconfig --name hub
kind load docker-image "cluster-gateway:v0.0.0-non-etcd" --name hub
```

--------------------------------

### Proxy Subresource API Access (Bash)

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

These bash commands demonstrate how to interact with managed cluster APIs directly using the proxy subresource endpoint provided by Cluster Gateway. They show examples for retrieving pods, creating deployments, and checking cluster health, requiring authentication via a bearer token.

```bash
# Get pods from managed cluster using proxy subresource
curl -k https://api.hosting-cluster.com/apis/cluster.core.oam.dev/v1alpha1/clustergateways/my-managed-cluster/proxy/api/v1/namespaces/default/pods \
  -H "Authorization: Bearer ${TOKEN}"

# Create a deployment in managed cluster
curl -k -X POST \
  https://api.hosting-cluster.com/apis/cluster.core.oam.dev/v1alpha1/clustergateways/my-managed-cluster/proxy/apis/apps/v1/namespaces/default/deployments \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "apiVersion": "apps/v1",
    "kind": "Deployment",
    "metadata": {"name": "nginx"},
    "spec": {
      "replicas": 3,
      "selector": {"matchLabels": {"app": "nginx"}},
      "template": {
        "metadata": {"labels": {"app": "nginx"}},
        "spec": {"containers": [{"name": "nginx", "image": "nginx:1.14"}]}
      }
    }
  }'

# Check cluster health via proxy with impersonation
curl -k "https://api.hosting-cluster.com/apis/cluster.core.oam.dev/v1alpha1/clustergateways/my-managed-cluster/proxy/healthz?impersonate=true" \
  -H "Authorization: Bearer ${TOKEN}"
```

--------------------------------

### Verify Cluster Gateway Apiserver Functionality

Source: https://github.com/oam-dev/cluster-gateway/blob/master/docs/local-run.md

Tests if the apiserver aggregation is working correctly by listing available API resources and attempting to get a 'clustergateway' resource. A 404 error for 'clustergateway' is expected, indicating the API aggregation is functioning but the specific resource is not yet exposed directly.

```shell
$ KUBECONFIG=/tmp/hub.kubeconfig kubectl api-resources | grep clustergateway
$ KUBECONFIG=/tmp/hub.kubeconfig kubectl get clustergateway # A 404 error is expected
```

--------------------------------

### ClusterGateway Status Check (Bash/Kubectl/Curl)

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

Demonstrates how to query the health and status of managed clusters using the ClusterGateway resource. This includes using `kubectl` to get the status of a specific ClusterGateway and using `curl` to access the cluster health subresource directly via the API.

```bash
# Get ClusterGateway status
kubectl get clustergateway my-managed-cluster -o yaml

# Expected output structure:
# apiVersion: cluster.core.oam.dev/v1alpha1
# kind: ClusterGateway
# metadata:
#   name: my-managed-cluster
# spec:
#   provider: aws
#   access:
#     endpoint:
#       type: Const
#       const:
#         address: https://api.cluster.example.com:6443
# status:
#   healthy: true
#   healthyReason: ""

# List all managed clusters
kubectl get clustergateways

# Check specific cluster health subresource
curl -k https://api.hosting-cluster.com/apis/cluster.core.oam.dev/v1alpha1/clustergateways/my-managed-cluster/health \
  -H "Authorization: Bearer ${TOKEN}"
```

--------------------------------

### RBAC for Proxy Subresource (Kubernetes YAML)

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

Configures Kubernetes Role-Based Access Control (RBAC) to manage permissions for accessing the proxy subresource of ClusterGateway objects. This ensures that only authorized users or groups can perform operations like getting, creating, or updating the proxy configurations for managed clusters.

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-gateway-proxy-reader
rules:
  # Access to ClusterGateway resources
  - apiGroups: ["cluster.core.oam.dev"]
    resources: ["clustergateways"]
    verbs: ["get", "list"]

  # Access to proxy subresource
  - apiGroups: ["cluster.core.oam.dev"]
    resources: ["clustergateways/proxy"]
    verbs: ["get", "create", "update"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: developer-cluster-access
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-gateway-proxy-reader
subjects:
  - kind: User
    name: developer@example.com
    apiGroup: rbac.authorization.k8s.io
  - kind: Group
    name: developers
    apiGroup: rbac.authorization.k8s.io
```

--------------------------------

### Pull Cluster Gateway Docker Image

Source: https://github.com/oam-dev/cluster-gateway/blob/master/README.md

This command pulls the Cluster Gateway Docker image from Docker Hub. Ensure you have Docker installed and configured. Replace 'v1.1.12' with the desired version tag.

```shell
docker pull oamdev/cluster-gateway:v1.1.12
```

--------------------------------

### Apiserver Deployment Configuration (Bash)

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

These bash commands illustrate how to run the Cluster Gateway apiserver with various configuration flags and feature gates. They show basic startup commands and how to enable specific features like ClientIdentityPenetration, HealthinessCheck, and set a custom user agent.

```bash
# Run apiserver with basic configuration
./apiserver \
  --secure-port=9443 \
  --secret-namespace=open-cluster-management-credentials \
  --feature-gates=ClientIdentityPenetration=true,HealthinessCheck=true \
  --authorization-mode=RBAC \
  --cluster-gateway-proxy-config=/etc/config/proxy-config.yaml \
  --ocm-integration=true

# With custom user agent
./apiserver \
  --secure-port=9443 \
  --secret-namespace=open-cluster-management-credentials \
  --user-agent=cluster-gateway/v1.0.0 \
  --authorization-mode=RBAC
```

--------------------------------

### Create Multi-Cluster Informer (Go)

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

This Go snippet demonstrates how to create Kubernetes informers that watch resources in a specific managed cluster. It configures a client to connect to a remote cluster, sets up a shared informer factory, and adds event handlers for Pod resources. It requires the Kubernetes client-go libraries and controller-runtime.

```go
package main

import (
    "context"
    "fmt"
    "time"

    multicluster "github.com/oam-dev/cluster-gateway/pkg/apis/cluster/transport"
    corev1 "k8s.io/api/core/v1"
    "k8s.io/apimachinery/pkg/runtime"
    "k8s.io/client-go/informers"
    "k8s.io/client-go/kubernetes"
    "k8s.io/client-go/kubernetes/scheme"
    "k8s.io/client-go/tools/cache"
    "k8s.io/client-go/tools/clientcmd"
    "sigs.k8s.io/controller-runtime/pkg/manager"
    controllers "sigs.k8s.io/controller-runtime"
)

func main() {
    cfg, err := clientcmd.BuildConfigFromFlags("", "/path/to/kubeconfig")
    if err != nil {
        panic(err)
    }

    // Prepend cluster proxy path for specific cluster
    clusterName := "my-managed-cluster"
    cfg.Wrap(multicluster.NewProxyPathPrependingClusterGatewayRoundTripper(clusterName).NewRoundTripper)

    // Native Kubernetes client informer
    nativeClient := kubernetes.NewForConfigOrDie(cfg)
    sharedInformer := informers.NewSharedInformerFactory(nativeClient, 0)
    podInformer := sharedInformer.Core().V1().Pods().Informer()

    podInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
        AddFunc: func(obj interface{}) {
            pod := obj.(*corev1.Pod)
            fmt.Printf("Pod Added: %s/%s\n", pod.Namespace, pod.Name)
        },
        UpdateFunc: func(oldObj, newObj interface{}) {
            pod := newObj.(*corev1.Pod)
            fmt.Printf("Pod Updated: %s/%s\n", pod.Namespace, pod.Name)
        },
        DeleteFunc: func(obj interface{}) {
            pod := obj.(*corev1.Pod)
            fmt.Printf("Pod Deleted: %s/%s\n", pod.Namespace, pod.Name)
        },
    })

    ctx, cancel := context.WithCancel(context.Background())
    defer cancel()

    go sharedInformer.Start(ctx.Done())

    // Wait for cache sync
    if !cache.WaitForCacheSync(ctx.Done(), podInformer.HasSynced) {
        panic("failed to sync cache")
    }

    fmt.Println("Informer synced, watching pods...")
    time.Sleep(60 * time.Second)
}
```

--------------------------------

### Kubernetes Client Context Helper (Go)

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

Provides utilities for embedding and retrieving cluster information within a Go context. This allows standard Kubernetes client operations to be directed to specific remote clusters by wrapping the context with cluster-specific details. It's useful for managing requests across multiple environments like production, staging, and development.

```go
package main

import (
    "context"

    multicluster "github.com/oam-dev/cluster-gateway/pkg/apis/cluster/transport"
)

func main() {
    // Add cluster context to request
    ctx := context.Background()
    clusterCtx := multicluster.WithMultiClusterContext(ctx, "production-cluster")

    // Retrieve cluster context
    clusterName, exists := multicluster.GetMultiClusterContext(clusterCtx)
    if exists {
        println("Target cluster:", clusterName)
    }

    // Use in multiple operations
    contexts := map[string]context.Context{
        "prod":    multicluster.WithMultiClusterContext(ctx, "prod-cluster"),
        "staging": multicluster.WithMultiClusterContext(ctx, "staging-cluster"),
        "dev":     multicluster.WithMultiClusterContext(ctx, "dev-cluster"),
    }

    // Pass to Kubernetes client operations
    for env, clusterCtx := range contexts {
        println("Environment:", env)
        // Use clusterCtx with client.Get(), client.List(), etc.
    }
}
```

--------------------------------

### Kubernetes Client Context Helper

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

Utilities for embedding cluster information into Kubernetes client requests using context.

```APIDOC
## Kubernetes Client Context Helper

### Description
Provides utilities to add and retrieve multi-cluster context information within a `context.Context` object. This allows Kubernetes clients to target specific clusters.

### Method
N/A (Helper functions, not an API endpoint)

### Endpoint
N/A

### Parameters
N/A

### Request Example
```go
import (
    "context"
    multicluster "github.com/oam-dev/cluster-gateway/pkg/apis/cluster/transport"
)

// Add cluster context to request
ctx := context.Background()
clusterCtx := multicluster.WithMultiClusterContext(ctx, "production-cluster")

// Retrieve cluster context
clusterName, exists := multicluster.GetMultiClusterContext(clusterCtx)
if exists {
    println("Target cluster:", clusterName)
}

// Use in multiple operations
contexts := map[string]context.Context{
    "prod":    multicluster.WithMultiClusterContext(ctx, "prod-cluster"),
    "staging": multicluster.WithMultiClusterContext(ctx, "staging-cluster"),
    "dev":     multicluster.WithMultiClusterContext(ctx, "dev-cluster"),
}
```

### Response
N/A
```

--------------------------------

### Compile Cluster Gateway e2e Benchmark Suite

Source: https://github.com/oam-dev/cluster-gateway/blob/master/README.md

This command compiles the end-to-end benchmark suite for the Cluster Gateway. This is useful for performance testing. It requires the 'make' utility and a Go development environment.

```shell
make e2e-benchmark-binary
```

--------------------------------

### Build Docker Image for Cluster Gateway

Source: https://github.com/oam-dev/cluster-gateway/blob/master/docs/local-run.md

Builds a Docker image for the cluster gateway with a specific tag. This is the first step in setting up the local environment.

```shell
docker build \
  -t "cluster-gateway:v0.0.0-non-etcd" \
  -f cmd/apiserver/Dockerfile .
```

--------------------------------

### Create ClusterGateway from Secret (X.509 Certificate) (YAML)

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

Illustrates creating a ClusterGateway resource via a Kubernetes Secret using X.509 client certificates for authentication. The Secret includes base64 encoded CA certificate, client certificate, client key, and endpoint.

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: cluster-bar
  namespace: open-cluster-management-credentials
  labels:
    cluster.core.oam.dev/cluster-credential-type: X509Certificate
    cluster.core.oam.dev/cluster-endpoint-type: Const
type: Opaque
data:
  ca.crt: LS0tLS1CRUdJTi... # base64 CA certificate
  tls.crt: LS0tLS1CRUdJTi... # base64 client certificate
  tls.key: LS0tLS1CRUdJTi... # base64 client private key
  endpoint: aHR0cHM6Ly8xMjcuMC4wLjE6NjQ0Mw== # base64 "https://127.0.0.1:6443"
```

--------------------------------

### Create ClusterGateway from Secret (ServiceAccountToken) (YAML)

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

Demonstrates how to create a ClusterGateway resource implicitly by defining a Kubernetes Secret with specific labels. This method uses ServiceAccountToken for authentication. The Secret contains base64 encoded CA certificate, token, and endpoint.

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: cluster-foo
  namespace: open-cluster-management-credentials
  labels:
    cluster.core.oam.dev/cluster-credential-type: ServiceAccountToken
    cluster.core.oam.dev/cluster-endpoint-type: Const
type: Opaque
data:
  ca.crt: LS0tLS1CRUdJTi... # base64 CA certificate
  token: ZXlKaGJHY2lPaUpTVXpJ... # base64 service account token
  endpoint: aHR0cHM6Ly8xMjcuMC4wLjE6NjQ0Mw== # base64 "https://127.0.0.1:6443"
```

--------------------------------

### List Namespaces in Managed Cluster using Tweaked Kubeconfig

Source: https://github.com/oam-dev/cluster-gateway/blob/master/docs/local-run.md

Uses the modified kubeconfig ('hub-managed1.kubeconfig') to list namespaces in the 'managed1' cluster. This verifies that direct proxying and access to the remote cluster's resources are working.

```shell
# list namespaces under cluster managed1
KUBECONFIG=/tmp/hub-managed1.kubeconfig kubectl get ns
```

--------------------------------

### Kubernetes Manifests for Cluster Gateway Deployment

Source: https://github.com/oam-dev/cluster-gateway/blob/master/docs/local-run.md

Defines the Kubernetes resources required to deploy the cluster gateway apiserver. This includes a Deployment, Service, APIService for API aggregation, and RBAC roles/rolebindings for necessary permissions.

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gateway-deployment
  labels:
    app: gateway
spec:
  replicas: 3
  selector:
    matchLabels:
      app: gateway
  template:
    metadata:
      labels:
        app: gateway
    spec:
      containers:
        - name: gateway
          image: "cluster-gateway:v0.0.0-non-etcd"
          command:
            - ./apiserver
            - --secure-port=9443
            - --secret-namespace=default
            - --feature-gates=APIPriorityAndFairness=false
          ports:
            - containerPort: 9443
---
apiVersion: v1
kind: Service
metadata:
  name: gateway-service
spec:
  selector:
    app: gateway
  ports:
    - protocol: TCP
      port: 9443
      targetPort: 9443
---
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v1alpha1.cluster.core.oam.dev
  labels:
    api: cluster-extension-apiserver
    apiserver: "true"
spec:
  version: v1alpha1
  group: cluster.core.oam.dev
  groupPriorityMinimum: 2000
  service:
    name: gateway-service
    namespace: default
    port: 9443
  versionPriority: 10
  insecureSkipTLSVerify: true
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: system::extension-apiserver-authentication-reader:cluster-gateway
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: extension-apiserver-authentication-reader
subjects:
  - kind: ServiceAccount
    name: default
    namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: cluster-gateway-secret-reader
rules:
  - apiGroups:
      - ""
    resources:
      - "secrets"
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cluster-gateway-secret-reader
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cluster-gateway-secret-reader
subjects:
  - kind: ServiceAccount
    name: default
    namespace: default
---

```

--------------------------------

### Craft Kubeconfig for Direct Proxying to Managed Cluster

Source: https://github.com/oam-dev/cluster-gateway/blob/master/docs/local-run.md

Modifies the existing 'hub' cluster's kubeconfig to enable direct proxying to the 'managed1' cluster. It appends the specific proxy path to the server URL, allowing kubectl commands to target 'managed1' through the gateway.

```shell
$ cat /tmp/hub.kubeconfig \
    | sed 's/\(server: .*\)/\1\/apis\/cluster.core.oam.dev\/v1alpha1\/clustergateways\/managed1\/proxy\//' \
    > /tmp/hub-managed1.kubeconfig
```

--------------------------------

### APIService Registration

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

Manifest for registering the ClusterGateway API with the Kubernetes API aggregation layer.

```APIDOC
## APIService Registration

### Description
Defines an `APIService` resource to register the ClusterGateway API (e.g., `cluster.core.oam.dev/v1alpha1`) with the Kubernetes API server's aggregation layer. This makes the Cluster Gateway resources discoverable and accessible via the main Kubernetes API endpoint.

### Method
N/A (Kubernetes APIService manifest)

### Endpoint
N/A

### Parameters
N/A

### Request Example
```yaml
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v1alpha1.cluster.core.oam.dev
spec:
  group: cluster.core.oam.dev
  version: v1alpha1
  service:
    name: cluster-gateway
    namespace: cluster-gateway-system
    port: 443
  groupPriorityMinimum: 2000
  versionPriority: 10
  insecureSkipTLSVerify: false
  caBundle: <base64-encoded-ca-bundle>
```

### Response
N/A
```

--------------------------------

### APIService Registration (Kubernetes YAML)

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

Defines an APIService resource to register the ClusterGateway API with the Kubernetes API aggregation layer. This makes the ClusterGateway API discoverable and accessible through the main Kubernetes API endpoint, allowing other components to interact with it.

```yaml
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v1alpha1.cluster.core.oam.dev
spec:
  group: cluster.core.oam.dev
  version: v1alpha1
  service:
    name: cluster-gateway
    namespace: cluster-gateway-system
    port: 443
  groupPriorityMinimum: 2000
  versionPriority: 10
  insecureSkipTLSVerify: false
  caBundle: <base64-encoded-ca-bundle>
```

--------------------------------

### RBAC for Proxy Subresource

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

Defines Kubernetes RBAC roles and bindings to control access to the proxy subresource of ClusterGateway resources.

```APIDOC
## RBAC for Proxy Subresource

### Description
Configures Kubernetes Role-Based Access Control (RBAC) to manage permissions for accessing the proxy subresource of ClusterGateway resources. This ensures that only authorized users or service accounts can proxy requests to managed clusters.

### Method
N/A (Kubernetes RBAC manifests)

### Endpoint
N/A

### Parameters
N/A

### Request Example
```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-gateway-proxy-reader
rules:
  # Access to ClusterGateway resources
  - apiGroups: ["cluster.core.oam.dev"]
    resources: ["clustergateways"]
    verbs: ["get", "list"]

  # Access to proxy subresource
  - apiGroups: ["cluster.core.oam.dev"]
    resources: ["clustergateways/proxy"]
    verbs: ["get", "create", "update"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: developer-cluster-access
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-gateway-proxy-reader
subjects:
  - kind: User
    name: developer@example.com
    apiGroup: rbac.authorization.k8s.io
  - kind: Group
    name: developers
    apiGroup: rbac.authorization.k8s.io
```

### Response
N/A
```

--------------------------------

### Define ClusterGateway Resource (YAML)

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

Defines a custom resource for a managed Kubernetes cluster, including provider, endpoint, and credential configuration. This is a declarative way to represent a managed cluster within the Cluster Gateway.

```yaml
apiVersion: cluster.core.oam.dev/v1alpha1
kind: ClusterGateway
metadata:
  name: my-managed-cluster
spec:
  provider: "aws"
  access:
    endpoint:
      type: Const
      const:
        address: "https://api.cluster.example.com:6443"
        caBundle: <base64-encoded-ca-cert>
        insecure: false
    credential:
      type: ServiceAccountToken
      serviceAccountToken: <token-value>
```

--------------------------------

### Delete KinD Cluster

Source: https://github.com/oam-dev/cluster-gateway/blob/master/docs/local-run.md

Deletes a KinD cluster. This command is used for cleaning up the local Kubernetes environment after development or testing.

```shell
$ kind delete cluster --name tmp
```

--------------------------------

### Create Secret for Multi-Cluster X509 Authentication

Source: https://github.com/oam-dev/cluster-gateway/blob/master/docs/local-run.md

Defines a Kubernetes Secret of type Opaque to store X509 credentials for connecting to a remote cluster ('managed1'). It requires the endpoint, CA certificate, TLS certificate, and private key for the remote cluster.

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: managed1
  labels:
    cluster.core.oam.dev/cluster-credential-type: X509
type: Opaque # <--- Has to be opaque
data:
  endpoint: "..." # Should NOT be 127.0.0.1
  ca.crt: "..." # ca cert for cluster "managed1"
  tls.crt: "..." # x509 cert for cluster "managed1"
  tls.key: "..." # private key for cluster "managed1"
```

--------------------------------

### Create Secret for Multi-Cluster Dynamic Credential Fetching

Source: https://github.com/oam-dev/cluster-gateway/blob/master/docs/local-run.md

Defines a Kubernetes Secret of type Opaque to store configuration for dynamically fetching cluster credentials via an external command for a remote cluster ('managed1'). It requires the endpoint and an 'exec' configuration in JSON format.

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: managed1
  labels:
    cluster.core.oam.dev/cluster-credential-type: Dynamic
type: Opaque # <--- Has to be opaque
data:
  endpoint: "..." # ditto
  exec: "..." # an exec config in JSON format; see ExecConfig (https://github.com/kubernetes/kubernetes/blob/2016fab3085562b4132e6d3774b6ded5ba9939fd/staging/src/k8s.io/client-go/tools/clientcmd/api/types.go#L206, https://kubernetes.io/docs/reference/access-authn-authz/authentication/#configuration)
```

--------------------------------

### Create Secret for Multi-Cluster Service Account Token Authentication

Source: https://github.com/oam-dev/cluster-gateway/blob/master/docs/local-run.md

Defines a Kubernetes Secret of type Opaque to store Service Account token credentials for connecting to a remote cluster ('managed1'). It requires the endpoint, CA certificate, and a working JWT token.

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: managed1
  labels:
    cluster.core.oam.dev/cluster-credential-type: ServiceAccountToken
type: Opaque # <--- Has to be opaque
data:
  endpoint: "..." # ditto
  ca.crt: "..." # ditto
  token: "..." # working jwt token
```

--------------------------------

### Proxy Request to Remote Cluster Health Endpoint

Source: https://github.com/oam-dev/cluster-gateway/blob/master/docs/local-run.md

Sends a request to the '/healthz' endpoint of a remote cluster ('managed1') via the Cluster Gateway. This demonstrates successful proxying to a managed cluster.

```shell
$ KUBECONFIG=/tmp/hub.kubeconfig kubectl get \
      --raw "/apis/cluster.core.oam.dev/v1alpha1/clustergateways/managed1/proxy/healthz"
```

--------------------------------

### ClusterGateway Status Check

Source: https://context7.com/oam-dev/cluster-gateway/llms.txt

API endpoints for querying the health and status of managed clusters via the ClusterGateway resource.

```APIDOC
## ClusterGateway Status Check

### Description
Allows querying the health and operational status of clusters managed by the Cluster Gateway. This involves checking the status of `ClusterGateway` resources and their associated health endpoints.

### Method
GET

### Endpoint
- `/apis/cluster.core.oam.dev/v1alpha1/clustergateways/{cluster-name}` (for detailed status)
- `/apis/cluster.core.oam.dev/v1alpha1/clustergateways` (to list all)
- `/apis/cluster.core.oam.dev/v1alpha1/clustergateways/{cluster-name}/health` (specific health subresource)

### Parameters
#### Path Parameters
- **cluster-name** (string) - Required - The name of the managed cluster to check.

#### Query Parameters
N/A

#### Request Body
N/A

### Request Example
```bash
# Get ClusterGateway status for a specific cluster
kubectl get clustergateway my-managed-cluster -o yaml

# List all managed clusters
kubectl get clustergateways

# Check specific cluster health subresource via curl
curl -k https://api.hosting-cluster.com/apis/cluster.core.oam.dev/v1alpha1/clustergateways/my-managed-cluster/health \
  -H "Authorization: Bearer ${TOKEN}"
```

### Response
#### Success Response (200)
- **status** (object) - Contains the health status of the cluster.
  - **healthy** (boolean) - Indicates if the cluster is healthy.
  - **healthyReason** (string) - Provides a reason if the cluster is not healthy.

#### Response Example
```yaml
apiVersion: cluster.core.oam.dev/v1alpha1
kind: ClusterGateway
metadata:
  name: my-managed-cluster
spec:
  provider: aws
  access:
    endpoint:
      type: Const
      const:
        address: https://api.cluster.example.com:6443
status:
  healthy: true
  healthyReason: ""
```
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.