<p>I am able to create deployment and able to run kubectl get * command on master nodes</p>
<pre><code>vagrant@kubemaster:~$ kubectl get nodes
NAME         STATUS   ROLES           AGE   VERSION
kubemaster   Ready    control-plane   45h   v1.28.0
kubenode01   Ready    &lt;none&gt;          45h   v1.28.0
kubenode02   Ready    &lt;none&gt;          45h   v1.28.0
</code></pre>
<p>But i am not able to run kubectl get nodes command on worker nodes. Is it not allowed intentially? Like all cluster management command need to be trigger from master nodes? If this the behaviour then why it is being done?</p>
<pre><code>vagrant@kubenode01:~$ kubectl get nodes
E0821 14:15:26.901943    3604 memcache.go:265] couldn't get current server API group list: Get &quot;http://localhost:8080/api?timeout=32s&quot;: dial tcp [::1]:8080: connect: connection refused
E0821 14:15:26.903398    3604 memcache.go:265] couldn't get current server API group list: Get &quot;http://localhost:8080/api?timeout=32s&quot;: dial tcp [::1]:8080: connect: connection refused
E0821 14:15:26.904235    3604 memcache.go:265] couldn't get current server API group list: Get &quot;http://localhost:8080/api?timeout=32s&quot;: dial tcp [::1]:8080: connect: connection refused
E0821 14:15:26.906582    3604 memcache.go:265] couldn't get current server API group list: Get &quot;http://localhost:8080/api?timeout=32s&quot;: dial tcp [::1]:8080: connect: connection refused
E0821 14:15:26.908914    3604 memcache.go:265] couldn't get current server API group list: Get &quot;http://localhost:8080/api?timeout=32s&quot;: dial tcp [::1]:8080: connect: connection refused
The connection to the server localhost:8080 was refused - did you specify the right host or port?
vagrant@kubenode01:~$ 
</code></pre>

Thinker
<p>First, the API server is not accessible from the worker nodes using <code>localhost:8080</code>, because the API server runs only on <code>kubemaster</code>. But, by default, <code>kubectl</code> use <code>localhost:8080</code>. In your case, you must replace <code>localhost:8080</code> by the URL of the API server. Assuming:</p>
<ul>
<li><code>kubemaster</code> is reachable from <code>kubenode01</code></li>
<li>API server runs on port <code>6443</code></li>
</ul>
<p>You can use:</p>
<pre class="lang-bash prettyprint-override"><code>kubectl --server=https://kubemaster:6443 --insecure-skip-tls-verify=true get nodes
</code></pre>
<p>(<code>insecure-skip-tls-verify=true</code> is used to avoid having &quot;Certificate signed by unknown authority error&quot;)</p>
<p>This still won't work, because it will ask for <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">authentication</a>. But if you provide the right credentials (e.g. generate a token, user certificates, ...), the following command should succeed:</p>
<pre class="lang-bash prettyprint-override"><code>kubectl \
    --server=https://kubemaster:6443 \
    --insecure-skip-tls-verify=true \
    --client-certificate client.crt \
    --client-key client.key \
    get nodes
</code></pre>
<p><strong>For testing purpose only</strong>, you can get the admin's <code>client.crt</code> and <code>client.key</code> from the <code>kubemaster</code>'s admin file (something like <code>/etc/kubernetes/admin.conf</code>).</p>
<p>If you want a more secure authentication, and only want to list the nodes from the worker, you can define a <code>serviceaccount</code>, a <code>clusterrole</code>, and a <code>clusterrolebinding</code>. From <code>kubemaster</code>, run:</p>
<pre class="lang-bash prettyprint-override"><code>kubectl create serviceaccount worker

kubectl create clusterrole list-nodes --verb=list --resource=nodes

kubectl create clusterrolebinding worker-list-nodes \
    --clusterrole=list-nodes --serviceaccount=default:worker

kubectl create token worker # copy the token
</code></pre>
<p>Then, from the worker node, using the token you've previously copied:</p>
<pre class="lang-bash prettyprint-override"><code>kubectl \
    --server=https://kubemaster:6443 \
    --token=&quot;ey...&quot; \
    --insecure-skip-tls-verify=true \
    get nodes
</code></pre>
