code: func InClusterConfig() (*Config, error) {
  	host, port := os.Getenv("KUBERNETES_SERVICE_HOST"), os.Getenv("KUBERNETES_SERVICE_PORT")
  	if len(host) == 0 || len(port) == 0 {
  		return nil, fmt.Errorf("unable to load in-cluster configuration, KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT must be defined")
  	}
  
  	token, err := ioutil.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/" + api.ServiceAccountTokenKey)
  	if err != nil {
  		return nil, err
  	}
  	tlsClientConfig := TLSClientConfig{}
  	rootCAFile := "/var/run/secrets/kubernetes.io/serviceaccount/" + api.ServiceAccountRootCAKey
  	if _, err := util.CertPoolFromFile(rootCAFile); err != nil {
  		glog.Errorf("Expected to load root CA config from %s, but got err: %v", rootCAFile, err)
  	} else {
  		tlsClientConfig.CAFile = rootCAFile
  	}
  
  	return &Config{
  		// TODO: switch to using cluster DNS.
  		Host:            "https://" + net.JoinHostPort(host, port),
  		BearerToken:     string(token),
  		TLSClientConfig: tlsClientConfig,
  	}, nil
  }
docs: // InClusterConfig returns a config object which uses the service account
  // kubernetes gives to pods. It's intended for clients that expect to be
  // running inside a pod running on kuberenetes. It will return an error if
  // called from a process not running in a kubernetes environment.