<p>I have a kubernetes cluster. I created the cluster using the <code>Google Cloud</code>, but not using the GKE, but using GCE. I've created one <code>master node</code> and two <code>worker nodes</code> using <code>VM instances</code>. <code>Kubeadm</code> is used for joining the master and worker nodes along with <code>kube-flannel.yml</code> file. I am exposing my cluster outside in <code>postman</code> using my <code>Vm's public ip &amp; nodePort</code>. I am able to hit to that URL. <code>publicip:nodePort/adapter_name</code>. The hit is reaching my pods and logs are generating. When I used <code>minikube</code> before, I've used <code>port-forwarding</code> to expose my port. Now i am not using that.</p>
<p>There is a default <code>kubeconfig</code> file called config is present in the location <code>$HOME/.kube/config</code>. It have the following content in it.</p>
<pre><code>apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1ekNDQWMrZ0F3SUJ....
    server: https://10.128.0.12:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFe....
    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb.....
</code></pre>
<p>The server <code>IP</code> is <code>https://10.128.0.12:6443</code>. Can I change this default URL to the one required for authentication[my rest api url]??</p>
<p>My requirement is to provide authentication for my rest api url, that my application enables, while running in the kubernetes pod.</p>
<p>How can I authenticate my rest api url with this <code>kubeconfig</code> method or by creating a new  kubeconfig file and using that??</p>
<p><a href="https://unofficial-kubernetes.readthedocs.io/en/latest/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/" rel="nofollow noreferrer">https://unofficial-kubernetes.readthedocs.io/en/latest/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/</a></p>
<p><a href="http://docs.shippable.com/deploy/tutorial/create-kubeconfig-for-self-hosted-kubernetes-cluster/" rel="nofollow noreferrer">http://docs.shippable.com/deploy/tutorial/create-kubeconfig-for-self-hosted-kubernetes-cluster/</a></p>
<p>I got few ideas from above two blogs and tried to implement that, but none of them is satisfying my requirement. Authentication via postman using any JWT token is also acceptable.</p>
<p>Kubernetes version:</p>
<pre><code>Client Version: version.Info{Major:&quot;1&quot;, Minor:&quot;19&quot;, GitVersion:&quot;v1.19.4&quot;, GitCommit:&quot;d360454c9bcd1634cf4cc52d1867af5491dc9c5f&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2020-11-11T13:17:17Z&quot;, GoVersion:&quot;go1.15.2&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;} 
Server Version: version.Info{Major:&quot;1&quot;, Minor:&quot;19&quot;, GitVersion:&quot;v1.19.4&quot;, GitCommit:&quot;d360454c9bcd1634cf4cc52d1867af5491dc9c5f&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2020-11-11T13:09:17Z&quot;, GoVersion:&quot;go1.15.2&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;} 
</code></pre>

<p>The best method to authenticate our client api/end point url is to use <code>Istio</code></p>
<p><a href="https://istio.io/latest/docs/concepts/what-is-istio/" rel="nofollow noreferrer">Istio installation</a></p>
<p>I documeneted whole process of providing security via Istio in a PDF file which i am attaching <a href="https://pdfhost.io/v/emsAoXAbr_Istio_Installation_Integration_and_Security_with_Kubernetes_Cluster_Open_sourcepdf.pdf" rel="nofollow noreferrer">here</a>. Istio is used for the verification of the token and Keycloak is used for the generation of the JWT Token.</p>
