<p>I've been trying to enabled token auth for HTTP REST API Server access from a remote client.</p>

<p>I installed my CoreOS/K8S cluster controller using this script:  <a href="https://github.com/coreos/coreos-kubernetes/blob/master/multi-node/generic/controller-install.sh" rel="noreferrer">https://github.com/coreos/coreos-kubernetes/blob/master/multi-node/generic/controller-install.sh</a></p>

<p>My cluster works fine.  This is a TLS installation so I need to configure any kubectl clients with the client certs to access the cluster.</p>

<p>I then tried to enable token auth via running:</p>

<pre><code> echo `dd if=/dev/urandom bs=128 count=1 2&gt;/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2&gt;/dev/null`
</code></pre>

<p>this gives me a token.  I then added the token to a token file on my controller containing a token and default user:</p>

<pre><code>$&gt; cat /etc/kubernetes/token

3XQ8W6IAourkXOLH2yfpbGFXftbH0vn,default,default
</code></pre>

<p>I then modified the /etc/kubernetes/manifests/kube-apiserver.yaml to add in:</p>

<pre><code> - --token-auth-file=/etc/kubernetes/token
</code></pre>

<p>to the startup param list</p>

<p>I then reboot (not sure the best way to restart API Server by itself??)</p>

<p>At this point, kubectl from a remote server quits working(won't connect).   I then look at <code>docker ps</code> on the controller and see the api server.  I run <code>docker logs container_id</code> and get no output.  If I look at other docker containers I see output like:</p>

<pre><code>    E0327 20:05:46.657679       1 reflector.go:188] 
    pkg/proxy/config/api.go:33: Failed to list *api.Endpoints: 
    Get http://127.0.0.1:8080/api/v1/endpoints?resourceVersion=0: 
dial tcp 127.0.0.1:8080: getsockopt: connection refused
</code></pre>

<p>So it appears that my api-server.yaml config it preventing the API Server from starting properly....</p>

<p>Any suggestions on the proper way to configure API Server for bearer token REST auth?</p>

<p>It is possible to have both TLS configuration and Bearer Token Auth configured, right?</p>

<p>Thanks!</p>

<p>I think your kube-apiserver dies because it's can't find the <code>/etc/kubernetes/token</code>. That's because on your deployment the apiserver is a static pod therefore running in a container which in turn means it has a different root filesystem than that of the host.</p>

<p>Look into <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code> and add a <code>volume</code> and a <code>volumeMount</code> like this (I have omitted the lines that do not need changing and don't help in locating the correct section):</p>

<pre><code>kind: Pod
metadata:
  name: kube-apiserver
spec:
  containers:
  - name: kube-apiserver
    command:
    - ...
    - --token-auth-file=/etc/kubernetes/token
    volumeMounts:
    - mountPath: /etc/kubernetes/token
      name: token-kubernetes
      readOnly: true
  volumes:
  - hostPath:
      path: /etc/kubernetes/token
    name: token-kubernetes
</code></pre>

<p>One more note: the file you quoted as <code>token</code> should <strong>not</strong> end in <code>.</code> (dot) - maybe that was only a copy-paste mistake but check it anyway. The format is documented under <a href="https://kubernetes.io/docs/admin/authentication/#static-token-file" rel="noreferrer">static token file</a>:</p>

<blockquote>
  <p>token,user,uid,"group1,group2,group3"</p>
</blockquote>

<p>If your problem perists execute the command below and post the output:</p>

<pre><code>journalctl -u kubelet | grep kube-apiserver
</code></pre>
