Using kubectl via an SSH Tunnel
In this post, I’d like to share one way (not the only way!) to use kubectl to access your Kubernetes cluster via an SSH tunnel. In the future, I may explore some other ways (hit me on Twitter if you’re interested). I’m sharing this information because I suspect it is not uncommon for folks deploying Kubernetes on the public cloud to want to deploy them in a way that does not expose them to the Internet. Given that the use of SSH bastion hosts is not uncommon, it seemed reasonable to show how one could use an SSH tunnel to reach a Kubernetes cluster behind an SSH bastion host.
If you’re unfamiliar with SSH bastion hosts, see this post for an overview.
To use kubectl via an SSH tunnel through a bastion host to a Kubernetes cluster, there are two steps required:
- The Kubernetes API server needs an appropriate Subject Alternative Name (SAN) on its certificate.
- The Kubeconfig file needs to be updated to reflect the tunnel details.
Ensuring an Appropriate SAN for the API Server
As is the case with just about any TLS-secured connection, if the destination to which you’re connecting with kubectl doesn’t match any of Continue reading
