discover_openapi.py

Discover the OpenAPI v3 group/versions of a kcp workspace and print their spec URLs.

Talks to the cluster via kubectl get --raw. Auth is handled by the OIDC exec credential in the kubeconfig (kubectl oidc-login) — first run opens a browser, the token is cached afterwards.

Requirements

• kubectl — Kubernetes CLI (transport).
• kubectl-oidc-login (a.k.a. kubelogin) — kubectl plugin providing the oidc-login subcommand referenced by the kubeconfig exec block.
• Python 3 — standard library only, no pip packages.

Install (macOS / Homebrew)

brew install kubectl
brew install int128/kubelogin/kubelogin   # provides the kubectl-oidc-login plugin

Install (Krew — any platform)

# kubectl
# see https://kubernetes.io/docs/tasks/tools/

# kubelogin via krew (https://krew.sigs.k8s.io/ must be installed)
kubectl krew install oidc-login

Verify

kubectl version --client
kubectl oidc-login --help    # plugin found

Usage

# interactive: prompts org vs workspace scope, lists group/versions, pick one
python3 discover_openapi.py

# skip prompt
python3 discover_openapi.py --scope ws     # sub workspace (/workspaces/gisela)
python3 discover_openapi.py --scope org    # org level (root)

# non-interactive: just print every groupVersion spec URL
python3 discover_openapi.py --scope ws --dump

# other kubeconfig
python3 discover_openapi.py --kubeconfig ./gisela-corp.kubeconfig --scope ws

Defaults: --kubeconfig ./gisela-corp.kubeconfig, workspace gisela (change WORKSPACE in the script).

kcp gotcha

kubectl get --raw ignores the path part of --server (uses scheme+host only). The kcp workspace therefore cannot be selected via the server URL — it must be the prefix of the raw path (/workspaces/gisela/openapi/v3). The script does this; passing the workspace via --server silently hits the org root and returns the wrong (global) API surface.