Access a Kubernetes cluster without VPN
Give your team secure kubectl access to a private K8s cluster. No public API server, no VPN appliance, no split-tunnel nightmares.
The problem
Your Kubernetes API server is on a private subnet. Engineers need kubectl access from their laptops — at home, at coffee shops, on the road. The traditional options are painful:
- Expose the API server publicly — unacceptable security risk, even with RBAC
- Site-to-site VPN — slow to set up, gives full network access, breaks when NAT changes
- Bastion host + SSH tunnel — fragile, hard to audit, one more thing to maintain
What you actually want: give specific users access to port 6443 on the API server, and nothing else. That's what Zero Trust means in practice.
The solution: WireZTNA publisher on the cluster network
Install a WireZTNA publisher — a single 8 MB static binary — on any machine that can reach the K8s API server. This can be:
- A node in the cluster
- A sidecar container in a utility pod
- A VM on the same VPC
- A DaemonSet (for HA)
The publisher initiates an outbound WireGuard tunnel to the WireZTNA broker. No inbound ports needed. No firewall rules to open.
Step 1: Create a publisher in the admin panel
In the WireZTNA web panel, create a new publisher. Set the exposed CIDRs to just the API server:
Exposed CIDRs: 10.0.1.50/32 # Your K8s API server IP
Or, use a Published App for even tighter control:
Published App: "K8s API"
Host: 10.0.1.50
Port: 6443
Protocol: TCP
Step 2: Install the publisher
On a machine with network access to the API server:
# Download and install
curl -fsSL https://your-broker.wireztna.com/api/v1/downloads/publisher/linux/amd64 -o wireztna-publisher
chmod +x wireztna-publisher
# Enroll with the token from the admin panel
./wireztna-publisher enroll --token "pub_xxxxxxxxxxxxxxxx"
# Start (runs as a systemd service)
sudo ./wireztna-publisher install
sudo systemctl start wireztna-publisher
That's it. The publisher is now connected to the broker and advertising the API server CIDR.
Step 3: Assign access
In the admin panel, create a group (e.g., "Platform Engineers") and link it to the publisher. Add users to the group. Each user will only be able to reach the specific CIDRs or Published Apps you defined — nothing else on the network.
Step 4: Connect from the client
Engineers install the WireZTNA client and enroll:
# Enroll (one-time)
wireztna enroll https://your-broker.wireztna.com/enroll/TOKEN
# Login
wireztna login
# Now kubectl works directly
kubectl get pods --server=https://10.0.1.50:6443
The client establishes a WireGuard tunnel to the broker, which routes traffic to the publisher, which forwards it to the API server. The user's machine gets a split-DNS entry so k8s.internal resolves through the tunnel.
Why this is better than a VPN
- Granular access — users can only reach port 6443 on the API server, not SSH into nodes or access databases
- No inbound ports — the publisher initiates outbound connections; works behind any firewall or NAT
- Per-session keys — PSK rotates every 8 hours by default; even if compromised, the window is limited
- Audit trail — you see who connected, when, and which resources they accessed
- Multi-cluster — add publishers to each cluster, assign different teams to different clusters through groups
DaemonSet deployment (optional HA)
For production clusters, run the publisher as a DaemonSet so it's always available:
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: wireztna-publisher
namespace: wireztna
spec:
selector:
matchLabels:
app: wireztna-publisher
template:
metadata:
labels:
app: wireztna-publisher
spec:
hostNetwork: true
containers:
- name: publisher
image: wireztna/publisher:latest
env:
- name: WIREZTNA_TOKEN
valueFrom:
secretKeyRef:
name: wireztna-publisher
key: token
securityContext:
capabilities:
add: ["NET_ADMIN"]
Summary
Total time to set up: under 10 minutes. No VPN appliance, no firewall rules, no public exposure. Your engineers get kubectl access from anywhere, and you maintain full visibility and control over who accesses what.