<p>I want to ask how to access Kubelet API from microk8s cluster.</p>

<p>I looked to this <a href="https://microk8s.io/docs/ports" rel="nofollow noreferrer">url</a> and it says that Kubelet API requires client certificate.
So I called this (from /var/snap/microk8s/current/certs)
<code>curl -v https://127.0.0.1:10250 --cert ca.crt --cert-type PEM --cacert ca.crt --key ca.key</code></p>

<p>But I got error saying:
<code>curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.</code></p>

<p>How do I fix this issue? Also, what is the difference between kubelet.crt, server.crt, and ca.crt in microk8s?</p>

<p>Thank you!</p>

<p><a href="https://i.stack.imgur.com/KDeDK.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/KDeDK.png" alt="enter image description here"></a></p>

<p>Try this:</p>

<pre><code>curl --verbose \
  --cert ./server.crt \
  --key ./server.key  \
  --insecure \
  https://127.0.0.1:10250/healthz
</code></pre>

<p>The CA cert in the <code>certs</code> directory is not the signer of the cert :10250 presents to the user. I don't know where the CA cert being presented comes from, it looks like it's rotated as the issuer is <code>CN=&lt;servername&gt;-ca@1567568834</code> ( hence the <code>--insecure</code>).</p>

<p>The <code>kube-apiserver</code> command line will include the exact path to the kubelet client certs (or could also be stored in a config file in the new k8s world)</p>

<p><code>--kubelet-client-certificate</code>
 <code>--kubelet-client-key</code></p>

<pre><code>$ pgrep -a kube-apiserver | perl -pe 's/ --/\n --/g'
22071 /snap/microk8s/1247/kube-apiserver
 --cert-dir=/var/snap/microk8s/1247/certs
 --service-cluster-ip-range=10.22.189.0/24
 --authorization-mode=RBAC,Node
 --basic-auth-file=/var/snap/microk8s/1247/credentials/basic_auth.csv
 --service-account-key-file=/var/snap/microk8s/1247/certs/serviceaccount.key
 --client-ca-file=/var/snap/microk8s/1247/certs/ca.crt
 --tls-cert-file=/var/snap/microk8s/1247/certs/server.crt
 --tls-private-key-file=/var/snap/microk8s/1247/certs/server.key
 --kubelet-client-certificate=/var/snap/microk8s/1247/certs/server.crt
 --kubelet-client-key=/var/snap/microk8s/1247/certs/server.key
 --secure-port=16443
 --token-auth-file=/var/snap/microk8s/1247/credentials/known_tokens.csv
 --token-auth-file=/var/snap/microk8s/1247/credentials/known_tokens.csv
 --etcd-servers=https://127.0.0.1:12379
 --etcd-cafile=/var/snap/microk8s/1247/certs/ca.crt
 --etcd-certfile=/var/snap/microk8s/1247/certs/server.crt
 --etcd-keyfile=/var/snap/microk8s/1247/certs/server.key
 --requestheader-client-ca-file=/var/snap/microk8s/1247/certs/front-proxy-ca.crt
 --requestheader-allowed-names=front-proxy-client
 --requestheader-extra-headers-prefix=X-Remote-Extra-
 --requestheader-group-headers=X-Remote-Group
 --requestheader-username-headers=X-Remote-User
 --proxy-client-cert-file=/var/snap/microk8s/1247/certs/front-proxy-client.crt
 --proxy-client-key-file=/var/snap/microk8s/1247/certs/front-proxy-client.key

</code></pre>
