It appears kubectl has first-class support via api-resources like:
$ kubectl api-resources -o wide
$ kubectl api-resources --api-group certificates.k8s.io -o wide
$ kubectl api-resources --namespaced -o wide
Alternatively, we can use curl to query Kubernetes API, but we have to expose the API endpoint first: