How to Join a Kubernetes Worker Node to a Master via Public IP with kubeadm

Quick Navigation

Difficulty: Intermediate
Estimated Time: 15-25 minutes
Prerequisites: Ubuntu server, kubeadm installed, a running master node, basic networking knowledge

Securely Connect Worker Nodes to Your Master from Anywhere

Introduction

You're setting up your Kubernetes cluster using kubeadm, and your goal is simple: Join a remote worker node to the master node using a public IP.

But then reality hits you: kubeadm join fails. Ports are blocked. Certificates don't match. The API server is unreachable.

Don't worry — you're not alone. This is a common pain point when working with Kubernetes across cloud servers, home labs, or any environment where nodes aren't on the same private network.

In this guide, you'll learn step-by-step how to expose your Kubernetes master node safely over a public IP, and successfully connect your worker nodes from anywhere .

Highlights

Works with Ubuntu + kubeadm Handles public IP exposure safely Covers firewall, certificates, and kube-apiserver config CLI-based, no GUI needed Quick reset + rejoin method for broken joins

Step-by-Step Guide

On the Master Node (mydev3)

1. Allow the Kubernetes API server port (6443)

sudo ufw allow 6443/tcp

If you're using iptables, firewalld, or a cloud provider security group, open port 6443 accordingly.

2. Configure the kube-apiserver manifest

Edit the static pod config:

sudo nano /etc/kubernetes/manifests/kube-apiserver.yaml

Ensure these flags are present under command::

- --advertise-address=YOUR_PUBLIC_IP
- --bind-address=0.0.0.0

Replace YOUR_PUBLIC_IP with your actual master node's public IP.

Save and close. The kubelet will auto-restart the API server since it's watching that directory.

3. Create or renew the join token

kubeadm token create --print-join-command

This outputs the exact kubeadm join command to run on your worker node

On the Worker Node (mydev4)

1. Clean up any old state

sudo kubeadm reset -f
sudo rm -rf /etc/cni /var/lib/cni /var/lib/kubelet /etc/kubernetes
sudo systemctl restart kubelet

2. Join the cluster via public IP

Use the command you got from the master node:

sudo kubeadm join YOUR_PUBLIC_IP:6443 \
--token <your-token> \
--discovery-token-ca-cert-hash sha256:<your-hash>

Verification

On your master node (mydev3):

kubectl get nodes

You should see mydev4 appear in the list as Ready

Final Thoughts

Connecting a Kubernetes worker node to a master over a public IP isn't trivial, but once you understand how kubeadm, certificates, and firewalls work together — it's totally doable

Tip: For production environments, always consider using a VPN, bastion host, or load balancer to secure the communication between nodes.

Now your cluster spans across the internet, and you've got full control from anywhere

Found this helpful?

Give it a , share it with your fellow DevOps and SRE friends, and follow for more Kubernetes deep dives!