<p>For testing purposes, I want to set up the kubernetes master to be only accessible from the local machine and not the outside. Ultimately I am going to run a proxy server docker container on the machine that is opened up to the outside. This is all inside a minikube VM.</p>

<p>I figure configuring kube-proxy is the way to go. I did the following</p>

<pre><code>kubeadm config view &gt; ~/cluster.yaml
# edit proxy bind address
vi ~/cluster.yaml
kubeadm reset
rm -rf /data/minikube
kubeadm init --config cluster.yaml
</code></pre>

<p>Upon doing <code>netstat -ln | grep 8443</code> i see <code>tcp        0      0 :::8443                 :::*                    LISTEN</code> which means it didn't take the IP.</p>

<p>I have also tried <code>kubeadm init --apiserver-advertise-address 127.0.0.1</code> but that only changes the advertised address to 10.x.x.x in the <code>kubeadm config view</code>. I feel that is probably the wrong thing anyways. I don't want the API server to be inaccessible to the other docker containers that need to access it or something.</p>

<p>I have also tried doing this <code>kubeadm config upload from-file --config ~/cluster.yaml</code> and then attempting to manually restart the docker running kube-proxy.
Also tried to restart the machine/cluster after kubeadm config change but couldn't figure that out. When you reboot a minikube VM by hand kubeadm command disappears and not even docker is running. Various online methods of restarting things dont seem to work either (could be just doing this wrong).</p>

<p>Also tried editing the kube-proxy docker's config file (bound to a local dir) but that gets overwritten when i restart the docker. I dont get it.</p>

<p>There's nothing in the kubernetes dashboard that allows me to edit the config file of the kube-proxy either (since its a daemonset).</p>

<p>Ultimately, I wish to use an authenticated proxy server sitting infront of the k8s master (apiserver specifically). Direct access to the k8s master from outside the VM will not work.</p>

<p>Thanks</p>

<p>you could limit it via the local network configuration. (Firewall, Routes)
As far as I know, the API needs to be accessible, at least via the local network where the other nodes reside in. Except you want to have a single node "cluster".</p>

<p>So, when you do not have a different network card, where you could advertise or bind the address to, you need to limit it then by the above mentioned Firewall or Route rules.</p>

<p>To your initial question topic, did you look into this issue? <a href="https://github.com/kubernetes/kubernetes/issues/39586" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/39586</a></p>
