<p>I have a kubernetes cluster on EKS, in which I would like to send requests to the kubelet server (not the kube-apiserver, but the kubelet, which runs on each of the worker nodes).
My understanding is that the kubelet runs an http server on port 10250, so I opened the firewall (security group) in one of the worker nodes for that port so I can reach it from my IP. Example of a request:</p>

<p><code>curl -k https://public-ip-of-worker-node:10250/metrics/probes</code></p>

<p>but I get a 401 in response. I guess this is expected, as I am not authenticating in any way. 
So, how can I authenticate to the kubelet server? I can communicate without problem with the kube-apiserver using kubectl, so I do have enough permissions from the <a href="https://docs.aws.amazon.com/eks/latest/userguide/managing-auth.html" rel="nofollow noreferrer">IAM side.</a></p>

<p>From the <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/" rel="nofollow noreferrer">docs</a> start the kubelet with the <code>--authentication-token-webhook</code> and the <code>--kubeconfig</code> flags.</p>

<p>Then you can create a service-account and define role and rolebinding on the service account and use the service accounts bearer token with the curl command to call the kubelet API.</p>
