Expose Api-Server with Dex and Traefik
Prologue For most GlueOps clusters, kube-apiserver sits behind a private network and the only way in is through our internal tooling. That works well until the moment a customer says: “I just want to kubectl get pods on my own cluster.” At that point we have three bad options: ship them a long-lived ServiceAccount token (a credential we can never really rotate), give them a shared admin kubeconfig (auditing nightmare), or ask them to VPN in every time (friction we don’t want to charge them for). ...