<p>I have setup a <code>kubernetes</code> cluster from scratch. This just means I did not use services provided by others, but used the k8s installer it self. Before we used to have other clusters, but with providers and they give you <code>tls cert and key</code> for auth, etc. Now this cluster was setup by myself, I have access via <code>kubectl</code>:</p>

<pre><code>$ kubectl get all
NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   10.96.0.1    &lt;none&gt;        443/TCP   21h
$
</code></pre>

<p>I also tried <a href="https://shocksolution.com/2018/12/14/creating-kubernetes-secrets-using-tls-ssl-as-an-example/" rel="nofollow noreferrer">this</a> and I can add a custom key, but then when I try to query via curl I get <code>pods is forbidden: User "system:anonymous" cannot list resource "pods" in API group "" at the cluster scope</code>.</p>

<p>I can not figure out where can I get the cert and key for a user to authenticate using the API for tls auth. I have tried to understand the official docs, but I have got nowhere. Can someone help me find where those files are or how to add or get certificates that i can use for the rest API? </p>

<p><strong>Edit1:</strong> my .kube.config file looks like this:</p>

<pre><code>apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0t(...)=
    server: https://private_IP:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: LS0tLS(...)Qo=
    client-key-data: LS0(...)tCg==
</code></pre>

<p>It works from the localhost just normally.
In the other hand I noticed something. From the localhost I can access the cluster by generating the token using <a href="https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#without-kubectl-proxy" rel="nofollow noreferrer">this</a> method.</p>

<p>Also notice that for now I do not mind about creating multiple roles for multiple users, etc. I just need access to the API from remote and can be using "default" authentication or roles.
Now when I try to do the same from remote I get the following:</p>

<ol>
<li>I tried using that config to run <code>kubectl get all</code> from remote, it runs for a while and then ends in <code>Unable to connect to the server: dial tcp</code>private_IP:6443<code>: i/o timeout.</code> </li>
<li>This happens because the config has <code>private_IP</code>, then I changed the IP to <code>Public_IP:6443</code> and now get the following : <code>Unable to connect to the server: x509: certificate is valid for some_private_IP, My_private_IP, not Public_IP:6443</code></li>
<li>Keep present that this is and <code>AWS ec2</code> instance with <code>elastic IP</code> (You can think of Elastic IP as just a public IP on a traditional setup, but this public ip is on your public router and then this router routes requests to your actual server on private network). For AWS fans like I said, I can not use the EKS service here.</li>
</ol>

<p>So how do I get this to be able to use the Public IP?</p>

wti
<p>You need to setup RBAC for the user. define roles and rolebinding. follow the link for reference -> <a href="https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/" rel="nofollow noreferrer">https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/</a></p>
