title: Unable to access Kubernetes dashboard from outside the cluster
body: <p>I have setup Kubernetes cluster comprising a master and three nodes. I used the following for the setup:<br>
  1. kubeadm (1.7.1)<br>
  2. kubectl (1.7.1)<br>
  3. kubelet (1.7.1)<br>
  4. weave (weave-kube-1.6)<br>
  5. docker (17.06.0~ce-0~debian) </p>
  
  <p>All the four instances have been setup in Google Cloud and the OS is Debian GNU/Linux 9 (stretch)</p>
  
  <pre><code>$ kubectl get pods --all-namespaces
  NAMESPACE     NAME                             READY     STATUS    RESTARTS   AGE
  kube-system   etcd-master                      1/1       Running   0          19m
  kube-system   kube-apiserver-master            1/1       Running   0          19m
  kube-system   kube-controller-manager-master   1/1       Running   0          19m
  kube-system   kube-dns-2425271678-cq9wh        3/3       Running   0          24m
  kube-system   kube-proxy-q399p                 1/1       Running   0          24m
  kube-system   kube-scheduler-master            1/1       Running   0          19m
  kube-system   weave-net-m4bgj                  2/2       Running   0          4m
  
  
  $ kubectl get nodes
  NAME      STATUS     AGE       VERSION
  master    Ready      1h        v1.7.1
  node1     Ready      6m        v1.7.1
  node2     Ready      5m        v1.7.1
  node3     Ready      7m        v1.7.1
  </code></pre>
  
  <p>The <em>apiserver</em> process is running with the following parameters:</p>
  
  <pre><code>root      1148  1101  1 04:38 ?  00:03:38 kube-apiserver 
  --experimental-bootstrap-token-auth=true --allow-privileged=true 
  --secure-port=6443
  --insecure-port=0 --service-cluster-ip-range=10.96.0.0/12 
  --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname 
  --requestheader-username-headers=X-Remote-User 
  --authorization-mode=Node,RBAC --advertise-address=10.128.0.2 
  --etcd-servers=http://127.0.0.1:2379
  </code></pre>
  
  <p>I ran the following commands for accessing the dashboard:</p>
  
  <pre><code>$ kubectl create -f https://rawgit.com/kubernetes/dashboard/master/src/deploy/kubernetes-dashboard.yaml
  serviceaccount "kubernetes-dashboard" created
  clusterrolebinding "kubernetes-dashboard" created
  deployment "kubernetes-dashboard" created
  </code></pre>
  
  <p>But since the dashboard was not accessible, i tried the following commands too although it didn't look quite relevant. Saw it somewhere.</p>
  
  <pre><code>kubectl create clusterrolebinding add-on-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:default
  </code></pre>
  
  <p>Finally, i came across a <a href="https://stackoverflow.com/a/41271878/361089">link</a> which looked relevant to my issue. I tried but i am getting the following error:</p>
  
  <pre><code>d:\Work&gt;kubectl --kubeconfig=d:\Work\admin.conf proxy -p 80
  Starting to serve on 127.0.0.1:80I0719 13:37:13.971200    5680 logs.go:41] http: proxy error: context canceled
  I0719 13:37:15.893200    5680 logs.go:41] http: proxy error: dial tcp 124.179.54.120:6443: connectex: No connection could be made
  because the target machine actively refused it.
  </code></pre>
  
  <p>If i do <code>telnet</code> to the master IP (124.179.54.120) from my laptop on port 22, it works but it doesn't work on port 6443. Port 6443 is open on master as i am able to <code>nc</code> on the given master port from my node machine as shown below:</p>
  
  <pre><code>tom@node1:~$ nc -zv 10.128.0.2 6443
  master.c.kubernetes-174104.internal [10.128.0.2] 6443 (?) open
  </code></pre>
  
  <p>On my laptop, firewall is already disabled and i also disabled firewall on master.</p>
  
  <pre><code># iptables -L
  Chain INPUT (policy ACCEPT)
  target     prot opt source               destination
  KUBE-SERVICES  all  --  anywhere             anywhere             /* kubernetes service portals */
  
  Chain FORWARD (policy ACCEPT)
  target     prot opt source               destination
  
  Chain OUTPUT (policy ACCEPT)
  target     prot opt source               destination
  KUBE-SERVICES  all  --  anywhere             anywhere             /* kubernetes service portals */
  
  Chain KUBE-SERVICES (2 references)
  target     prot opt source               destination
  </code></pre>
  
  <p>In Google Cloud console, i added TCP and UDP port 6443 to ingress requests in Google Cloud firewall's rule but still i am unable to access the dashboard using <code>http://localhost/ui</code></p>
  
  <p>Master config details:
  <a href="https://i.stack.imgur.com/XqLWb.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/XqLWb.png" alt="Master config details"></a></p>
  
  <p>Firewall config details:</p>
  
  <p><a href="https://i.stack.imgur.com/d0cxk.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/d0cxk.png" alt="Firewall config details"></a></p>
  
  <p>UPDATE: Content of <code>d:\Work\admin.conf</code></p>
  
  <pre><code>apiVersion: v1
  clusters:
  - cluster:
      certificate-authority-data: &lt;CA_cert&gt;
      server: https://124.179.54.120:6443
    name: kubernetes
  contexts:
  - context:
      cluster: kubernetes
      user: kubernetes-admin
    name: kubernetes-admin@kubernetes
  current-context: kubernetes-admin@kubernetes
  kind: Config
  preferences: {}
  users:
  - name: kubernetes-admin
    user:
      client-certificate-data: &lt;client-cert&gt;
      client-key-data: &lt;client-key&gt;
  </code></pre>
  
  <p>UPDATE1: From one of the three nodes, i ran the following command:</p>
  
  <pre><code>tom@node1:~$ curl -v http://127.0.0.1:8001
  * Rebuilt URL to: http://127.0.0.1:8001/
  *   Trying 127.0.0.1...
  * TCP_NODELAY set
  * Connected to 127.0.0.1 (127.0.0.1) port 8001 (#0)
  &gt; GET / HTTP/1.1
  &gt; Host: 127.0.0.1:8001
  &gt; User-Agent: curl/7.52.1
  &gt; Accept: */*
  &gt;
  &lt; HTTP/1.1 502 Bad Gateway
  &lt; Date: Thu, 20 Jul 2017 06:57:48 GMT
  &lt; Content-Length: 0
  &lt; Content-Type: text/plain; charset=utf-8
  &lt;
  * Curl_http_done: called premature == 0
  * Connection #0 to host 127.0.0.1 left intact
  </code></pre>