<p>I have copied rancher config file to local kube config, and once I tried to connect, get an error</p>

<pre><code>Unable to connect to the server: x509: certificate signed by unknown authority
</code></pre>

<p>I'm not admin of this cluster, and can't really change settings. So I googled that I can add</p>

<pre><code>insecure-skip-tls-verify: true
</code></pre>

<p>And removed certificates, leaving only username and token, and it starts to work.</p>

<p>Can you explain me, is it safe to use it like so, and why do we need certs at all if it could work without it as well?</p>

ogbofjnr
<p>You may treat it as additional layer of security. If you allow someone ( in this case to yourself ) to connect to cluster and manage it without a need to have a proper certificate, just keep in mind you allow it for everyone else.</p>

<pre><code>insecure-skip-tls-verify: true
</code></pre>

<p>is pretty self-explanatory - yes, it's insecure as it skips tls verification and it is not recommended on production. As you can read in <a href="https://kubernetes.io/docs/reference/kubectl/kubectl/" rel="nofollow noreferrer">documentation</a>:</p>

<blockquote>
  <p>--insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections
  insecure</p>
</blockquote>

<p>Username and token provide some level of security as they are still required to be able to connect but it has nothing to do with establishing secure trusted connection. By default it can only be done by clients who have also proper certificate.
If you don't want to skip tls verification, you may want to try <a href="https://imti.co/kubectl-remote-x509-valid/" rel="nofollow noreferrer">this</a> solution. Only for kubernetes >= 1.15 use command <code>kubeadm alpha certs renew all</code>.</p>

<p>More about managing TLS Certificates in a Kubernetes Cluster you can read <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/" rel="nofollow noreferrer">here</a>.</p>
