title: kubectl through load balancer
body: <p><strong>Flow:</strong><br>
  kubernetes cluster with api server (<a href="https://192.168.0.10:6443" rel="nofollow noreferrer">https://192.168.0.10:6443</a>) &lt;-> load balancer (10.10.0.2) &lt;-> laptop.  </p>
  
  <p><strong>Idea:</strong><br>
  From my laptop I would like to run kubectl pointing to load balancer where reveres proxy will redirect me to api server. </p>
  
  <p><strong>Steps:</strong><br>
  - I changed server ip in kubeconfig (on my laptop) file to LB's IP:<br>
  was <a href="https://192.168.0.10:6443" rel="nofollow noreferrer">https://192.168.0.10:6443</a> is <a href="http://10.10.0.2:8080/" rel="nofollow noreferrer">http://10.10.0.2:8080/</a><br>
  - I configured nginx like that:</p>
  
  <pre><code>server {
      listen 8080 default_server;
      listen [::]:8080 default_server;
      server_name _;
      location / {
              proxy_pass https://192.168.0.10:6443;
      }
  }
  </code></pre>
  
  <p>Now running for example <strong>kubectl get nodes</strong> I expected to get list of nodes but it won't work:  </p>
  
  <blockquote>
    <p>error: You must be logged in to the server (Unauthorized)</p>
  </blockquote>
  
  <pre><code>$ curl http://10.10.0.2:8080/
  {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {
  
    },
    "status": "Failure",
    "message": "Unauthorized",
    "reason": "Unauthorized",
    "code": 401
  </code></pre>
  
  <p>If I add to nginx config:</p>
  
  <pre><code>ssl on;
  ssl_certificate /root/certs/admin-k-master-1.pem;
  ssl_certificate_key /root/certs/admin-k-master-1-key.pem;
  </code></pre>
  
  <p>and change in kubeconfig file server IP to <strong><a href="https://10.10.0.2:8080/" rel="nofollow noreferrer">https://10.10.0.2:8080/</a></strong></p>
  
  <pre><code>$ kubect get nodes
  Unable to connect to the server: x509: certificate is valid for 192.168.0.10 not 10.10.0.2
  </code></pre>
  
  <p>There is similar <a href="https://stackoverflow.com/questions/45079988/kubernetes-ingress-vs-load-balancer">topic</a> but it's not related to kubectl.</p>
  
  <p>How can I achieve that? or what I am doing wrong.</p>