---
title: "Connect to a Cluster Through a Bastion Host | Hostman Docs"
description: "Manage a Kubernetes cluster without public IPs on master nodes. Set up a bastion host, copy kubeconfig, and run kubectl over a private network."
---

> For the complete documentation index for AI agents, see [llms.txt](https://hostman.com/llms.txt).

You can run a Kubernetes cluster without public IP addresses on its master nodes. This makes the cluster more secure, because the nodes aren't reachable directly from the internet. To manage such a cluster, use a bastion host: a cloud server with a public IP that is connected to the cluster's private network.

You connect to the bastion host over SSH and manage the cluster with `kubectl`. Requests to the cluster API travel over the private network, so you don't need to expose the API to the internet.

## Requirements

The cluster and the bastion host must be in the same private network. This lets the bastion host reach the cluster API at its private address without going through the internet.

## Check the Cluster's Private Network

To find out which network the cluster belongs to, open the dashboard:

1.  Go to the **Kubernetes** section and click the cluster.
2.  Open the **Network** tab.
3.  The network name is shown in the **Private Network** section.

## Create a Bastion Host

The bastion host must be reachable from the internet through a public IP and connected to the same private network as the Kubernetes cluster. 

1.  Go to [**Cloud Servers**](https://hostman.com/my/servers) and click **Create Server**.
2.  Select an image and a configuration. A minimal configuration is enough for a small number of SSH connections.
3.  Select the same region as the cluster.
4.  Select the **Public IP** option, or choose one of the IPv4 addresses available on your account.
5.  Select the private network the cluster belongs to.
6.  Finish creating the server. For more details, see [Create Cloud Servers](https://hostman.com/docs/cloud-servers/create-server/).

Once the server is created, note its public IP. You'll use it to connect to the bastion host over SSH.

The bastion host's private IP must belong to the same network as the cluster API address. For example, in the `192.168.0.0/24` network, the bastion host can have the private IP `192.168.0.10` and the cluster API can have `192.168.0.20`.

## Install kubectl on the Bastion Host

Install `kubectl` on the bastion host by following [our kubectl guide](https://hostman.com/docs/kubernetes/connect-to-clusters/kubectl/).

## Download kubeconfig

Download the `kubeconfig` file of the cluster:

1.  Go to the **Kubernetes** section and click the cluster.
2.  On the **Dashboard** tab, click the **download the configuration file** link.

![Charming Amalthea 2026 10 22 09 55](https://content.hostman.com/assets/ed084da8-665d-4458-bc4f-563cc61a2334.png?width=1920&height=869)

> [!NOTE]
> The `kubeconfig` file contains credentials for accessing the cluster and grants admin rights. If several people work with the cluster, [set up personal access](https://hostman.com/docs/kubernetes/access/managing-user-access/) and create separate user accounts on the bastion host.

The examples below assume the `kubeconfig` file is saved at `~/Downloads/kubeconfig.yaml`. Replace the path with your own.

Check the API address in `kubeconfig`. On your local computer, run:

```shell
grep server ~/Downloads/kubeconfig.yaml
```

The server field must contain the private IP of the cluster API, for example `https://192.168.0.20:6443`.

## Copy kubeconfig to the Bastion Host

1.  Connect to the bastion host from your local computer:
    

```shell
ssh user@public_IP
```

You can find the connection details [on your server's **Dashboard**](https://hostman.com/docs/cloud-servers/connect-to-server/).

2.  On the bastion host, create a directory for the configuration and set its permissions:
    

```shell
mkdir -p ~/.kube
chmod 700 ~/.kube
```

3.  Keep the SSH session open. In another terminal window on your local computer, copy `kubeconfig` to the server:
    

```shell
scp ~/Downloads/kubeconfig.yaml user@public_IP:~/.kube/hostman-cluster.yaml
```

Use the same user that created the directory. The configuration will be saved to `~/.kube/hostman-cluster.yaml` in that user's home directory.

5.  Go back to the SSH session. If you already have a `~/.kube/config` file you want to keep, save it under a different name first. Otherwise `mv -i` will ask you to confirm replacing it.
    
6.  Rename the file to config and make it readable and writable only by its owner:
    

```shell
mv -i ~/.kube/hostman-cluster.yaml ~/.kube/config
chmod 600 ~/.kube/config
```

`kubectl` uses `~/.kube/config` by default, so you don't need to specify the path in commands.

## Verify the Connection

On the bastion host, run:

```shell
kubectl get nodes
```

If the command returns a list of nodes, the connection is set up. Run any further `kubectl` commands on the bastion host.

If the command fails, check the following:

-   **Timeout**: check the private network and the address in the `server` field.
-   **Restricted outbound traffic on the bastion host**: allow outgoing TCP connections to the API's private IP on port 6443.
-   **`Unauthorized` error**: make sure you're using the `kubeconfig` of the right cluster and that its credentials are valid.