1. How to Access a Remote Cluster Locally

During development, you often need to connect directly to a remote Kubernetes cluster. The usual approach is to copy /etc/kubernetes/admin.conf to your local ~/.kube/kubeconfig.

But the kubeconfig’s server address is kubernetes.default.svc. So we need to configure a hosts entry:

1

1.1.1.1 kubernetes.default.svc

If you need to switch between different clusters, you not only have to swap the kubeconfig but also modify hosts. Here is a method that adds the remote access address directly to the cluster’s certificate, saving the step of editing hosts and also making it easier to tell different clusters apart.

2. See Which Addresses the Apiserver Certificate Contains

• Enter the certificate directory

1

cd /etc/kubernetes/pki

• View the certificate

1
2
3
4

openssl x509 -in apiserver.crt -noout -text

X509v3 Subject Alternative Name:
                DNS:1-1-1-1, DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster.local, DNS:lb-apiserver.kubernetes.local, DNS:localhost, IP Address:1.1.1.1

Here, access to the cluster’s Apiserver is allowed only through 1.1.1.1. If you want to use domain names such as kubernetes, kubernetes.default, kubernetes.default.svc, you need to configure hosts to point them at 1.1.1.1.

3. Add a New Domain or IP to the Certificate

• Back up the certificate

1
2
3

cd /etc/kubernetes/pki
mv apiserver.crt apiserver.crt.bak
mv apiserver.key apiserver.key.bak

• Modify kubeadm-config.yaml

kubeadm-config.yaml may be at /etc/kubernetes/kubeadm-config.yaml, or it may be at /root/kubeadm-config.yaml; the exact location depends on the installation method and the installation tooling.

Under the apiServer field of ClusterConfiguration, find certSANs.

1
2
3
4
5
6
7
8
9

apiVersion: kubeadm.k8s.io/v1beta2
kind: ClusterConfiguration
...
certSANs:
  - kubernetes
  - kubernetes.default
  - kubernetes.default.svc
  - kubernetes.default.svc.cluster.local
  - 10.233.0.1

Add the remote access domain or IP address to certSANs:

1
2
3
4
5
6
7

certSANs:
  - remote.domain.com
  - kubernetes
  - kubernetes.default
  - kubernetes.default.svc
  - kubernetes.default.svc.cluster.local
  - 10.233.0.1

• Regenerate the certificate

1

kubeadm init phase certs apiserver --config /root/kubeadm-config.yaml

It takes effect immediately after running. If there are multiple Masters, you need to update all the certificates one by one.

4. References

• https://kubesphereio.com/post/add-public-ip-to-kubernetes-apiserver-operation-guide/