Remote access kubeconfig files

MicroShift generates a default kubeconfig file that enables external clients to connect securely to the API server. The configuration uses the node hostname and certificate validation based on Subject Alternative Name (SAN) entries.

When a MicroShift node connects to the API server from an external source, a certificate with all alternative names listed in the SAN field is used for validation. MicroShift generates a default kubeconfig for external access by using the hostname value. The defaults are set in the <node.hostnameOverride>, <node.nodeIP>, and api.<dns.baseDomain> parameter values of the default kubeconfig file.

The /var/lib/microshift/resources/kubeadmin/<hostname>/kubeconfig file uses the hostname of the machine, or node.hostnameOverride if that option is set, to reach the API server. The CA in the kubeconfig file can validate certificates when the API server is accessed externally.

Example contents of a default kubeconfig file for remote access
clusters:
- cluster:
    certificate-authority-data: <base64 CA>
    server: https://microshift-rhel9:6443

← Previous: Access the MicroShift node locally | ↑ Up: Kubeconfig files for configuring node access | ⌂ Home: Red Hat build of MicroShift | Next: Remote access customization →