<p>I want to create a kubernetes cluster using KOPS that uses a private topology completely (all master/worker nodes are on private subnets, the API ELB is internal). </p>

<p>Once the cluster is created - how do I configure kubectl to use an ssh tunnel via my bastion server ?</p>

Doron
<p>I found a way to make <code>kubectl</code> to run through an SSH tunnel, it's not ideal, but until I find something better, I posted it now.</p>

<p>First create the tunnel:</p>

<pre><code>ssh -f user@XX.XX.XXX.XX -L 6443:localhost:6443 -N
</code></pre>

<p>Then copy the <code>~/.kube/config</code> file on your local machine and change the cluster <code>server</code> in order to point to 127.0.0.1 instead of the server URL or IP address.</p>

<p>As the certificates are made for the server where the master node has been created, you'll get the following error:</p>

<pre><code>Unable to connect to the server: x509: certificate is valid for 10.96.0.1, 10.0.0.1, not 127.0.0.1
</code></pre>

<p>You have to pass the <code>--insecure-skip-tls-verify=true</code> flag:</p>

<pre><code>kubectl --insecure-skip-tls-verify=true version
Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.3", GitCommit:"5e53fd6bc17c0dec8434817e69b04a25d8ae0ff0", GitTreeState:"clean", BuildDate:"2019-06-06T01:44:30Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.1", GitCommit:"4485c6f18cee9a5d3c3b4e523bd27972b1b53892", GitTreeState:"clean", BuildDate:"2019-07-18T09:09:21Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<p>I hope this helps, and I hope to find a better way to avoid this <code>--insecure-skip-tls-verify=true</code> flag.</p>

<hr>

<h1>Update</h1>

<p>Since my comment, I found the <a href="https://gravitational.com/teleport/" rel="noreferrer">Teleport</a> project from <a href="https://gravitational.com" rel="noreferrer">Gravitational</a>, which was initially an SSH tool to authenticate without passwords (you login once, with an <a href="https://en.wikipedia.org/wiki/One-time_password" rel="noreferrer">OTP</a>, and a certificate with a validity limited in time for your user is delivered and used to authenticated to the allowed servers.), is also Kubernetes compatible.</p>

<p>Basically you have to :</p>

<ol>
<li>deploy their binary and configure it (quite easy).</li>
<li>login using <code>tsh login --proxy https://yourserveripaddress:3080</code></li>
<li>use <code>kubectl</code> to access your cluster.</li>
</ol>

<p>The magic thing here is that Teleport will update your <code>~/.kube/config</code> file in order to access your cluster.</p>

<p>It really works well and you should consider giving it a try.</p>

<p>In the case you're using <a href="https://www.chef.io" rel="noreferrer">Chef</a>, I have made <a href="https://gitlab.com/pharmony/teleport-ce-cookbook/" rel="noreferrer">a cookbook for Teleport</a>.</p>
