<p>I am following the tutorial from <a href="https://coreos.com/kubernetes/docs/latest/kubernetes-on-aws.html" rel="nofollow noreferrer">Kubernetes on AWS</a> by Coreos (I need a Cloudformation template) to create a Kubernetes inside my already existing VPC.</p>

<p>Everything is configured properly and the cluster was successfully setup, but i am experiencing difficulties with Heapster/KubeDNS</p>

<p>My cluster info and config view look like this:</p>

<blockquote>
<pre><code>kubectl --kubeconfig=kubeconfig cluster-info
Kubernetes master is running at https://my-cluster-endpoint.company.com.
Heapster is running at https://my-cluster-endpoint.company.com./api/v1/proxy/namespaces/kube-system/services/heapster
KubeDNS is running at https://my-cluster-endpoint.company.com./api/v1/proxy/namespaces/kube-system/services/kube-dns

kubectl --kubeconfig=kubeconfig config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority: credentials/ca.pem
    server: https://my-cluster-endpoint.company.com.
  name: kube-aws-my-cluster-name-cluster
contexts:
- context:
    cluster: kube-aws-my-cluster-name-cluster
    namespace: default
    user: kube-aws-my-cluster-name-admin
  name: kube-aws-my-cluster-name-context
current-context: kube-aws-my-cluster-name-context
kind: Config
preferences: {}
users:
- name: kube-aws-my-cluster-name-admin
  user:
    client-certificate: credentials/admin.pem
    client-key: credentials/admin-key.pem
</code></pre>
</blockquote>

<p>So a few problems that I notice compared to the <a href="http://kubernetes.io/docs/getting-started-guides/aws/" rel="nofollow noreferrer">getting started guides from kubernetes.io</a>:</p>

<ol>
<li>All the "out of the box" services like Kibana/Grafana are missing (but these you can probably install yourself)</li>
<li>There is no "user" section with username and password to enter the dashboards only one with certificate</li>
</ol>

<p>As well when I try to reach these endpoints I immediately get "unauthorised" and the api does not even challenge me for username password</p>

<p>So how do I set basic authentication for my newly created cluster OR is there a way to login with the .pem certificate?</p>

<p>Thanks.  </p>

<p>The CoreOS-kubernetes tooling is meant to deploy a fully functioning Kubernetes cluster, but leave optional/ addon applications as a decision for the cluster admin. In this case kibana &amp; grafana are not strictly required for a fully functioning cluster -- so they are not deployed by default.</p>

<p>Similarly with authentication, basic-auth is not enabled by default (cert based auth and Bearer tokens are). However, you should be able to add basic auth by creating a file and a adding a flag to the api-server manifest:</p>

<ul>
<li><p>Create a basic auth file following the format described here: <a href="http://kubernetes.io/docs/admin/authentication" rel="nofollow">http://kubernetes.io/docs/admin/authentication</a></p></li>
<li><p>In <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code>, add a flag pointing to the file you created above <code>--basic-auth-file=SOMEFILE</code></p></li>
</ul>

<p>When you make the change to the <code>kube-apiserver.yaml</code> manifest, the kubelet will see the change an automatically restart the pod. If you're running apiservers on multiple hosts, be sure to make the above changes to each.</p>

<p>Another option is to use the <code>kubectl proxy</code> command to first authenticate against your api-server. See: <a href="http://kubernetes.io/docs/user-guide/connecting-to-applications-proxy" rel="nofollow">http://kubernetes.io/docs/user-guide/connecting-to-applications-proxy</a> - essentially the kubectl proxy will authenticate then allow you to access the endpoint locally on your machine.</p>
