<p>I have a kubernetes cluster. I created the cluster using the <code>Google Cloud</code>, but not using the GKE, but using GCE. I've created one <code>master node</code> and two <code>worker nodes</code> using <code>VM instances</code>. <code>Kubeadm</code> is used for joining the master and worker nodes along with <code>kube-flannel.yml</code> file. I am exposing my cluster outside in <code>postman</code> using my <code>Vm's public ip &amp; nodePort</code>. I am able to hit to that URL. <code>publicip:nodePort/adapter_name</code>. The hit is reaching my pods and logs are generating. When I used <code>minikube</code> before, I've used <code>port-forwarding</code> to expose my port. Now i am not using that.</p>
<p>There is a default <code>kubeconfig</code> file called config is present in the location <code>$HOME/.kube/config</code>. It have the following content in it.</p>
<pre><code>apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1ekNDQWMrZ0F3SUJ....
    server: https://10.128.0.12:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFe....
    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb.....
</code></pre>
<p>The server <code>IP</code> is <code>https://10.128.0.12:6443</code>. Can I change this default URL to the one required for authentication[my rest api url]??</p>
<p>My requirement is to provide authentication for my rest api url, that my application enables, while running in the kubernetes pod.</p>
<p>How can I authenticate my rest api url with this <code>kubeconfig</code> method or by creating a new  kubeconfig file and using that??</p>
<p><a href="https://unofficial-kubernetes.readthedocs.io/en/latest/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/" rel="nofollow noreferrer">https://unofficial-kubernetes.readthedocs.io/en/latest/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/</a></p>
<p><a href="http://docs.shippable.com/deploy/tutorial/create-kubeconfig-for-self-hosted-kubernetes-cluster/" rel="nofollow noreferrer">http://docs.shippable.com/deploy/tutorial/create-kubeconfig-for-self-hosted-kubernetes-cluster/</a></p>
<p>I got few ideas from above two blogs and tried to implement that, but none of them is satisfying my requirement. Authentication via postman using any JWT token is also acceptable.</p>
<p>Kubernetes version:</p>
<pre><code>Client Version: version.Info{Major:&quot;1&quot;, Minor:&quot;19&quot;, GitVersion:&quot;v1.19.4&quot;, GitCommit:&quot;d360454c9bcd1634cf4cc52d1867af5491dc9c5f&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2020-11-11T13:17:17Z&quot;, GoVersion:&quot;go1.15.2&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;} 
Server Version: version.Info{Major:&quot;1&quot;, Minor:&quot;19&quot;, GitVersion:&quot;v1.19.4&quot;, GitCommit:&quot;d360454c9bcd1634cf4cc52d1867af5491dc9c5f&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2020-11-11T13:09:17Z&quot;, GoVersion:&quot;go1.15.2&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;} 
</code></pre>

<p>Posting this as <code>Community Wiki</code>.</p>
<h3>I. Accesing Kubernetes API.</h3>
<blockquote>
<p>Can I change this default URL (cluster server IP address) to the one required for authentication my rest api url??</p>
</blockquote>
<p>I <strong>wouldn't recommend this</strong>. <code>KUBECONFIG</code> files are used to organize information about clusters, users, namespaces,  authentication mechanisms and to store information about your connection to the Kubernetes cluster. When you use kubectl to execute commands, it gets the correct communication information from this <code>KUBECONFIG</code>.</p>
<p>In <code>KUBECONFIG</code> you can authenticate using <code>X509 Client Certs</code> or different types of <code>Tokens</code>. More details can be found in <a href="https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#without-kubectl-proxy" rel="nofollow noreferrer">Authentication strategies</a> and <a href="https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/" rel="nofollow noreferrer">Access Clusters Using the Kubernetes API</a></p>
<p>If you are interested how to access <strong>kubernetes API</strong> using Beare Token, please check <a href="https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#without-kubectl-proxy" rel="nofollow noreferrer">this docs</a>.</p>
<h3>II. Accesing Client API</h3>
<p>If you want to expose your endpoint rest api as public, you could use:</p>
<ul>
<li><a href="https://kubernetes.io/docs/concepts/services-networking/service/#nodeport" rel="nofollow noreferrer">NodePort</a></li>
</ul>
<blockquote>
<p>Exposes the Service on each Node's IP at a static port (the NodePort). A ClusterIP Service, to which the NodePort Service routes, is automatically created. You'll be able to contact the NodePort Service, from outside the cluster, by requesting :.</p>
</blockquote>
<ul>
<li><a href="https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer" rel="nofollow noreferrer">LoadBalancer</a></li>
</ul>
<blockquote>
<p>Exposes the Service externally using a cloud provider's load balancer. NodePort and ClusterIP Services, to which the external load balancer routes, are automatically created.</p>
</blockquote>
<p><strong>Note:</strong> For bare metal env, consider using use <a href="https://metallb.universe.tf/" rel="nofollow noreferrer">Metallb</a></p>
<p>Kubernetes does not offer an implementation of network load-balancers (Services of type LoadBalancer) for bare metal clusters. The implementations of Network LB that Kubernetes does ship with are all glue code that calls out to various IaaS platforms (GCP, AWS, Azure…). If you’re not running on a supported IaaS platform (GCP, AWS, Azure…), LoadBalancers will remain in the “pending” state indefinitely when created.</p>
<p>Once you expose your api to the outside of the world (if necessary)</p>
<ul>
<li><p>you can use mutual TLS authentication between your client and sever(api) endpoint.</p>
</li>
<li><p>you can use <a href="https://kubernetes.github.io/ingress-nginx/" rel="nofollow noreferrer">Ingress</a> with <a href="https://learnk8s.io/microservices-authentication-kubernetes" rel="nofollow noreferrer">External OAUTH Authentication</a></p>
</li>
</ul>
<p>As alternative solution, you could consider <a href="https://www.keycloak.org/" rel="nofollow noreferrer">Keycloak</a> as additional authentication with <a href="https://www.keycloak.org/docs/latest/securing_apps/#_keycloak_generic_adapter" rel="nofollow noreferrer">Gatekeeper</a> in rest api as sidecare which verify if there was authentication.</p>
<p>If you would interested in authentications between microservices you can check <a href="https://learnk8s.io/microservices-authentication-kubernetes" rel="nofollow noreferrer">Authentication between microservices using Kubernetes identities</a> article.</p>
<p>If you are interested with istio, please take a look at <a href="https://istio.io/latest/docs/concepts/security/" rel="nofollow noreferrer">Istio Security</a>
Istio provides two types of authentication:</p>
<ul>
<li><strong>Peer authentication:</strong> used for service-to-service authentication to verify the client making the connection</li>
<li><strong>Request authentication:</strong> Used for end-user authentication to verify the credential attached to the request. Istio enables request-level authentication with JSON Web Token (JWT) validation and a streamlined developer experience using a custom authentication provider or any OpenID Connect providers -
<a href="https://mymusictaste.github.io/end-user-auth-with-istio-keycloak-eks/" rel="nofollow noreferrer">example</a></li>
</ul>
