<p>I am running a self managed kubernetes cluster on AWS EC2 instances( not EKS). I've used kubeadm to do the setup
The master and worker nodes are in public subnet and have public IPs.
I have set kube config in the worker and master nodes and I am able to run kubectl commands from the nodes, but I want to be able to run it from my local linux machine.</p>
<p>I have kubectl installed on my local and have copied over the kube config to ./kube/config in my local.</p>
<p>But when I run the kubectl command i get the error
$ kubectl get nodes
<code>E0929 12:04:43.319775   26908 memcache.go:265] couldn't get current server API group list: Get &quot;https://10.0.1.227:6443/api?timeout=32s&quot;: dial tcp 10.0.1.227:6443: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.</code></p>
<p>Now I know that this -  10.0.1.227 ,is the private IP of my master node and I cant connect to that from my local.</p>
<p>I tried by replacing the private ip with public ip of my master node(dumb solution I know) but it didn't work. got this error</p>
<pre><code>E0929 11:26:50.902035   25572 memcache.go:265] couldn't get current server API group list: Get &quot;https://3.110.130.136:6443/api?timeout=32s&quot;: tls: failed to verify certificate: x509: certificate is valid for 10.96.0.1, 10.0.1.227, not 3.110.130.136
</code></pre>
<p>Guessing cert in kube config is not generated for the public ip</p>
<p>FYI, port 6443 is open to all IPs in the security group.</p>
<p>How do I make this work?</p>

Aman Deep
<p>When initializing the Kubernetes Cluster with <code>kubeadmin</code>, you specified option <code>--apiserver-advertise-address</code> as the Private IP, so the certificate in the <code>~/.kube/config</code> file only authenticates for this IP.
To be able to use the <code>kubectl</code> command from local with Public IP you can do the following:</p>
<ol>
<li><p>Copy the K8S config file from <code>master node</code> to local and put it in the path <code>~/.kube/config</code></p>
</li>
<li><p>Open <code>~/.kube/config</code> file and change the Private IP in the <code>server</code> to Public IP</p>
</li>
<li><p>When using the <code>kubectl</code> command you will need to add the <code>--insecure-skip-tls-verify</code> option. Example:</p>
<pre><code>kubectl --insecure-skip-tls-verify get pods
</code></pre>
</li>
</ol>
<p>This is an easy and quick way or a better solution is to add your <code>Public IP</code> to the kubernetes config file to be able to use multiple IPs. You can follow the instructions below:<br />
<a href="https://devops.stackexchange.com/a/9506/31538">https://devops.stackexchange.com/a/9506/31538</a></p>
