# Is there a way to access microk8s using kubectl outside the local network

**URL:** <https://discuss.kubernetes.io/t/is-there-a-way-to-access-microk8s-using-kubectl-outside-the-local-network/15488>\
**Category:** microk8s\
**Created:** [April 10, 2021, 9:25pm UTC](https://discuss.kubernetes.io/t/is-there-a-way-to-access-microk8s-using-kubectl-outside-the-local-network/15488 "2021-04-10T21:25:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![horvatic](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/horvatic/32/7332_2.png) [@horvatic](https://discuss.kubernetes.io/u/horvatic)\
**Post date:** [April 10, 2021, 9:25pm UTC](https://discuss.kubernetes.io/t/is-there-a-way-to-access-microk8s-using-kubectl-outside-the-local-network/15488/1 "2021-04-10T21:25:12Z")

</div>

I am looking to run kubectl comamnds using github actions, but seem to have an issue. This issue is the cert generated using `microk8s config > config`. It seems to only work on my local network. Here is the error:

```auto
Unable to connect to the server: x509: certificate is valid for 127.0.0.1, *.*.*.*, *.*.*.*, *.*.*.*, *.*.*.*, *.*.*.*, not *.*.*.*

```

IP addresses have been removed.

Thoughts on how to fix?

---

<div class="post-metadata">

**Author:** ![balchua1](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/balchua1/32/5372_2.png) [@balchua1](https://discuss.kubernetes.io/u/balchua1)\
**Post date:** [April 10, 2021, 11:17pm UTC](https://discuss.kubernetes.io/t/is-there-a-way-to-access-microk8s-using-kubectl-outside-the-local-network/15488/2 "2021-04-10T23:17:04Z")

</div>

Is your node accessible from the internet via its `IP`? Or via some `DNS`?

If via some `IP` that is not defined in the node’s network interface, you can go to the file `/var/snap/microk8s/current/certs/csr.conf.template` and add something like this before the `#MOREIPS`.  
`IP.99=<your public ip>`  
And if it is `DNS`, do the same on the file, but instead of adding `IP.99` add `DNS.99`.  
i am choosing `99` just to be sure it doesn’t clash with the keys of your network interfaces ips.

---

<div class="post-metadata">

**Author:** ![horvatic](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/horvatic/32/7332_2.png) [@horvatic](https://discuss.kubernetes.io/u/horvatic)\
**Post date:** [April 10, 2021, 11:24pm UTC](https://discuss.kubernetes.io/t/is-there-a-way-to-access-microk8s-using-kubectl-outside-the-local-network/15488/3 "2021-04-10T23:24:43Z")

</div>

Yes, I can kubectrl with `insecure-skip-tls-verify: true` from outside my network using IP.

When I do the method you are suggesting do I need to refresh the certs or anything, or does it just work?

EDIT: It just works after the node automatically generates a new cert

---

<div class="post-metadata">

**Author:** ![balchua1](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/balchua1/32/5372_2.png) [@balchua1](https://discuss.kubernetes.io/u/balchua1)\
**Post date:** [April 11, 2021, 3:16am UTC](https://discuss.kubernetes.io/t/is-there-a-way-to-access-microk8s-using-kubectl-outside-the-local-network/15488/4 "2021-04-11T03:16:41Z")

</div>

It will automatically recreate the certs and restart the apiserver.