Access kubernetes cluster outside of VPN

Viewed 27

I configured a kubernetes cluster with rke on premise (for now single node - control plane, worker and etcd).

The VM which I launched the cluster on is inside a VPN.

After succesfully initializng the cluster, I managed to access the cluster with kubectl from inside the VPN.

I tried to access the cluster outside of the VPN so I updated the kubeconfig file and changed the followings:
server: https://<the VM IP> to be server: https://<the external IP>.
I also exposed port 6443.

When trying to access the cluster I get the following error:

E0912 16:23:39 proxy_server.go:147] Error while proxying request: x509: certificate is valid for <the VM IP>, 127.0.0.1, 10.43.0.1, not <the external IP>

My question is, how can I add the external IP to the certificate so I will be able to access the cluster with kubectl outside of the VPN.

The rke configuration yml.

# config.yml
nodes:
  - address: <VM IP>
    hostname_override: control-plane-telemesser
    role: [controlplane, etcd, worker]
    user: motti
    ssh_key_path: /home/<USR>/.ssh/id_rsa

ssh_key_path: /home/<USR>/.ssh/id_rsa

cluster_name: my-cluster

ignore_docker_version: false
    
kubernetes_version:

services:
  etcd:
    backup_config:
      interval_hours: 12
      retention: 6
    snapshot: true
    creation: 6h
    retention: 24h

  kube-api:
    service_cluster_ip_range: 10.43.0.0/16
    service_node_port_range: 30000-32767
    pod_security_policy: false

  kube-controller:
    cluster_cidr: 10.42.0.0/16
    service_cluster_ip_range: 10.43.0.0/16

  kubelet:
    cluster_domain: cluster.local
    cluster_dns_server: 10.43.0.10
    fail_swap_on: false
    extra_args:
      max-pods: 110

network:
  plugin: flannel
  options:
    flannel_backend_type: vxlan

dns:
  provider: coredns

authentication:
  strategy: x509

authorization:
  mode: rbac

ingress:
  provider: nginx
  options:
    use-forwarded-headers: "true"

monitoring:
  provider: metrics-server

Thanks,

1 Answers

So I found the solution for RKE cluster configuration.

You to add sans to the the cluster.yml file at the authentication section:

authentication:
    strategy: x509
    sans:
      - "10.18.160.10"

After you saved the file just run rke up again and it will update the cluster.

Related