<p>I was trying to Authenticate Kubernetes with External Vault using Hashicorps tutorial, <a href="https://learn.hashicorp.com/vault/identity-access-management/vault-agent-k8s" rel="nofollow noreferrer">https://learn.hashicorp.com/vault/identity-access-management/vault-agent-k8s</a></p>

<p>In below configuration, we have to provide the <code>END POINT</code> to our cluster in <code>K8S_HOST</code></p>

<pre><code>vault write auth/kubernetes/config \
        token_reviewer_jwt="$SA_JWT_TOKEN" \
        kubernetes_host="https://$K8S_HOST:8443" \
        kubernetes_ca_cert="$SA_CA_CRT"
</code></pre>

<p>I have setup the Kubernetes HA Cluster in private subnet and an ALB in frontend. I need help in configuring <code>K8S_HOST</code> end point.</p>

<p>As of now i have generated <code>SSL Certs</code> and recreated dashboard. 
Tried exposing the <code>kubernetes-dashboard</code> as <code>node port</code>.
Updated the certificate in ALB which is listening on 443. 
But still it not connecting to cluster.</p>

<p>So my doubt is  <code>K8S_HOST:8443</code> is the same end point for kubernetes dashboard or something else?</p>

<p>Proper way to get <code>K8S_HOST</code> details from a cluster in private subnet.</p>

<p>Can someone please help on this? I am struck here.</p>

Sreejith
<p>Use <code>kubectl config view</code> command to view cluster configuration:</p>

<pre class="lang-sh prettyprint-override"><code>$ kubectl config view --flatten --minify
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUN5RENDQWJDZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQjRYRFRJd01ETXdOakE0TlRFd05sb1hEVE13TURNd05EQTROVEV3Tmxvd0ZURVRNQkVHQTFVRQpBeE1LYTNWaVpYSnVaWFJsY3pDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTDRlClg5eWZpN0JhVVlUNmhUcEUvNm02WW5HczlZSHY3SmFMOGxsWWsvOENUVjBRcUk4VjBOYnB5V3ByQjBadmV4ZmMKQ0NTQ2hkYWFlcVBQWUJDckxTSGVoVllZcE1PK2UrMVFkTFN2RmpnZUQ1UHY0NFBqTW1MeFAzVkk0MFVZOXVNNwpCcjRueVRPYnJpWXJaSVhTYjdTbWRTdFg5TUgreVVXclNrRllGSEhnREVRdXF0dFRJZ1pjdUh2MzY3Nkpyc1FuCmI1TlM0ZHJyc0U0NVZUcWYrSXR1NzRSa1VkOUsvcTNHMHN1SlVMZ3AxOUZ4ZXorYTNRenJiUTdyWTlGUEhsSG4KVno1N1dWYmt2cjMzOUxnNWd0VzB4am10Q1hJaGgzNFRqRE1OazNza0VvcFBibjJPcER5STVUMUtOL3Vsa0FmTAptcXJ4bU5VNEVVYy9NcWFoVlVrQ0F3RUFBYU1qTUNFd0RnWURWUjBQQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCCi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFBL3c0OEFkdFU3Tkx2d0k1S2N4Y3hMMitBT0IKV29nakFKNUMwTlBTN1NDR2tWK2d6dlcrZHZVYWVtYTFHUFlJdUJuajBVR2k2QUF5SStES0tiY01iL2dVVUdKQQp0YVpEcFpidU1lZ1JZOVZ2dlpMZXRZQndESzkvWk9lYnF1MGh6eWo4TzduTnJaM3RIb3h6VW1MaVVIU2Jmc0R1CnkvaE9IM0wvUE1mZ0FFaHF5SVZwWGMvQzZCYWNlOEtRSWJMQ0hYZmZjTGhEWDQ0THZYSXVIL1Y3LzN1cHcxWm8KK05NcFY5Sys4TTExNHV2bWdyOHdTNkZHYlltdXFVZy9CTlpRd2FqKzVWMEZ6azZzeHoySTdZSXI3NHVNK3BLRgpMS3lEQzJnK2NXTU5YZTV0S0YrVG5zUXE1eWtNVEJKeHl1bTh5a3VtZTE4MGcyS1o3NzVTdVF1Ni9kND0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=

    server: https://127.0.0.1:32769 # &lt;&lt;-----------here
  name: kind-kind
contexts:
- context:
    cluster: kind-kind
    user: kind-kind
  name: kind-kind
current-context: kind-kind
kind: Config
preferences: {}
users:
- name: kind-kind
... ... ...
</code></pre>

<p>Copy the <code>server</code> address and use it as <code>kubernetes_host</code> while configuring Vault kubernetes auth method.</p>

<pre><code>$ vault write auth/kubernetes/config \
           token_reviewer_jwt="eyJhbGciOiJSUz....." \
           kubernetes_host="https://127.0.0.1:32769" \
           kubernetes_ca_cert=@examples/guides/vault-server/ca.crt

</code></pre>

<p><strong>N.B.:</strong> If the <code>server</code> address does not contain a port number, no need to add them. Keep the address as it is.</p>

<p>Demo sever address for GKE:</p>

<pre class="lang-yaml prettyprint-override"><code>server: https://35.203.181.169
</code></pre>

<p>Demo server address for DigitalOcean k8s cluster:</p>

<pre class="lang-yaml prettyprint-override"><code>server: https://e8dabcb3-**bb-451e****d5.k8s.ondigitalocean.com
</code></pre>
