# How to access private eks cluster apiserver via openziti

**URL:** <https://openziti.discourse.group/t/how-to-access-private-eks-cluster-apiserver-via-openziti/2826>\
**Category:** Ziti Overlay\
**Created:** [July 6, 2024, 1:31pm UTC](https://openziti.discourse.group/t/how-to-access-private-eks-cluster-apiserver-via-openziti/2826 "2024-07-06T13:31:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 6, 2024, 1:31pm UTC](https://openziti.discourse.group/t/how-to-access-private-eks-cluster-apiserver-via-openziti/2826/1 "2024-07-06T13:31:49Z")

</div>

I installed router in private eks cluster and had the following settings

```auto
helm upgrade --install "private-cluster" openziti/ziti-router \
--namespace ziti \
--set-file enrollmentJwt=./router-cluster.jwt \
--set edge.advertisedHost=private-router123-edge.ziti.svc.cluster.local \
--set linkListeners.transport.service.enabled=false \
--set tunnel.mode=host \
--set ctrl.endpoint="url:6262"

ziti edge update identity "router-cluster" \
    --role-attributes router-cluster

  ziti edge create identity "cluster-client" \
    --role-attributes cluster-clients \
    --jwt-output-file cluster-client.jwt

    ziti edge create config "router-cluster-i" intercept.v1 \
    '{"protocols":["tcp"],"addresses":["k8s.ziti.internal"], "portRanges":[{"low":443, "high":443}]}'

ziti edge create config "router-cluster-h" host.v1 \
    '{"protocol":"tcp", "address":"kubernetes.default.svc.cluster.local","port":443}'

ziti edge create service "router-cluster" \
    --configs router-cluster-i,router-cluster-h

ziti edge create edge-router-policy "default" \
    --edge-router-roles '#all' --identity-roles '#all'

ziti edge create service-edge-router-policy "default" \
    --edge-router-roles '#all' --service-roles '#all'

 ziti edge create service-policy "router-cluster" Dial \
    --service-roles '@router-cluster' --identity-roles '#cluster-clients'

ziti edge create service-policy "router-cluster-b" Bind \
    --service-roles '@router-cluster' --identity-roles '#router-cluster'  

  ziti edge policy-advisor services router-cluster -q   

```

Then in other network I installed kubeconfig and  
under server field I replaced url with `k8s.ziti.internal:443`

I was able to telnet but if I run kubectl commands i get

```E0706
E0706 13:22:36.022804 70399 memcache.go:265] couldn't get current server API group list: the server rejected our request for an unknown reason
E0706 13:22:36.086765 70399 memcache.go:265] couldn't get current server API group list: the server rejected our request for an unknown reason
E0706 13:22:36.149095 70399 memcache.go:265] couldn't get current server API group list: the server rejected our request for an unknown reason
E0706 13:22:36.209991 70399 memcache.go:265] couldn't get current server API group list: the server rejected our request for an unknown reason
Error from server (BadRequest): the server rejected our request for an unknown reason

```

---

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 6, 2024, 3:27pm UTC](https://openziti.discourse.group/t/how-to-access-private-eks-cluster-apiserver-via-openziti/2826/2 "2024-07-06T15:27:27Z")

</div>

ok by correcting the url to add` https:/`/ and running commands using `--insecure-skip-tls-verify=true` was able to access

---

<div class="post-metadata">

**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\
**Post date:** [July 7, 2024, 3:56pm UTC](https://openziti.discourse.group/t/how-to-access-private-eks-cluster-apiserver-via-openziti/2826/3 "2024-07-07T15:56:49Z")

</div>

Cool. I think you needed skip tls verify because the DNS name doesn't match the Kube API server cert's DNS SANs. You can re-issue that Kube API server cert with the intercept DNS name you chose to resolve that problem with TLS verify enabled ([ChatGPT instructions](https://chatgpt.com/share/d2e89209-2336-4824-bab8-03c7dcc475f0)).

[Another way is `kubeztl`](https://github.com/openziti-test-kitchen/kubeztl?tab=readme-ov-file#readme) which can replace `kubectl` for connecting to Kube API via OpenZiti.