<p>I stared my kubernetes cluster on AWS EC2 with kops using a private hosted zone in route53. Now when I do something like <code>kubectl get nodes</code>, the cli says that it can't connect to <code>api.kops.test.com</code> as it is unable to resolve it. So I fixed this issue by manually adding <code>api.kops.test.com</code> and its corresponding public IP (got through record sets) mapping in <code>/etc/hosts</code> file.</p>

<p>I wanted to know if there is a cleaner way to do this (without modifying the system-wide <code>/etc/hosts</code> file), maybe programmatically or through the cli itself.</p>

<p>Pragmatically speaking, I would add the public IP as a <code>IP</code> SAN to the master's x509 cert, and then just use the public IP in your kubeconfig. Either that, or the DNS record <em>not</em> in the private route53 zone.</p>

<p>You are in a situation where you purposefully made things private, so now they are.</p>

<hr>

<p>Another option, depending on whether it would be worth the effort, is to use a VPN server in your VPC and then connect your machine to EC2 where the VPN connection can add the EC2 DNS servers to your machine's config as a side-effect of connecting. Our corporate Cisco AnyConnect client does something very similar to that.</p>
