<p>I'm interested if I can run k8s with publicly available control plane and worker nodes in network behind firewall (which is edge/iot deployment use-case). The main concern as I believe is communication between apiserver and kubelet/ kube-proxy. Can it be configured as only node -> master communication? How can I achieve this?</p>

<p>I could not find precisize info besides this short note in kubelet <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/" rel="nofollow noreferrer">reference</a>:
<code>HTTP endpoint: HTTP endpoint passed as a parameter on the command line. This endpoint is checked every 20 seconds (also configurable with a flag).</code></p>

<p>For kube-proxy I could not find any info.</p>

<p>I'm also new to golang so analyzing the k8s source code is for now beyond my skill. Any help appreciated :)</p>

Piotr Kozimor
<blockquote>
  <p>Can it be configured as only node -> master communication? How can I achieve this?</p>
</blockquote>

<p>I would guess only trying it will prove for sure that the apiserver doesn't need to contact <code>kubelet</code>. However, related to that: be aware that in such a setup, <code>kubectl exec</code> and <code>kubectl logs</code> will no longer function because those commands connect directly to port 10254 on the kubelet binary instead of sending all that traffic through the API server</p>

<p>As for kube-proxy, <a href="https://github.com/kubernetes/kubernetes/blob/v1.17.0/cluster/addons/kube-proxy/kube-proxy-ds.yaml#L46-L47" rel="nofollow noreferrer">it appears</a> it uses the in-cluster <code>$KUBERNETES_SERVICE_HOST</code> which will be the <code>.1</code> IP of the <code>Service</code> CIDR and will use the software defined network to reach the apiserver. Although there are <a href="https://github.com/kubernetes/kubernetes/blob/v1.17.0/cluster/gce/manifests/kube-proxy.manifest#L60-L61" rel="nofollow noreferrer">other configurations</a> which volume mount a <code>kubeconfig</code> from the host, so I guess the ultimate answer will depend on how you installed your cluster.</p>
