<p>According to the <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/" rel="noreferrer">referrence</a>, two of the options <code>kube-apiserver</code> takes are <code>--bind-address</code> and <code>--advertise-address</code> It appears to me that they conflict each other.</p>
<p>What is/are the actual difference(s) between the two?</p>
<p>Is <code>--bind-address</code> the address that the <code>kube-apiserver</code> process will listen on?</p>
<p>Is <code>--advertise-address</code> the address that <code>kube-apiserver</code> will advertise as the address that it will be listening on? If so, how does it advertise? Does it do some kind of a broadcast over the network?</p>

<p>According to the <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/" rel="nofollow noreferrer">reference-kube-apiserver</a> that you are referencing:</p>
<blockquote>
<p>--advertise-address ip  The IP address on which to advertise the apiserver to members of the cluster. This address must be reachable by the rest of the cluster. If blank, the --bind-address will be used. If --bind-address is unspecified, the host's default interface will be used.</p>
</blockquote>
<p>and</p>
<blockquote>
<p>--bind-address ip  The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank, all interfaces will be used (0.0.0.0 for all IPv4 interfaces and :: for all IPv6 interfaces). (default 0.0.0.0)</p>
</blockquote>
<p>Those parameters are configurable, but please keep in mind they should be specified during cluster bootstrapping.</p>
<h3><a href="https://kubernetes.io/docs/concepts/security/controlling-access/#api-server-ports-and-ips" rel="nofollow noreferrer">API server ports and IP addresses</a></h3>
<ul>
<li>default “Secure port” is <code>6443</code>, but can be changed with the
<code>--secure-port</code> flag. As described in the <a href="https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports" rel="nofollow noreferrer">documentation</a> - master node should expose secure port for other cluster components to communicate with the Kubernetes API server.</li>
<li>default IP is first non-localhost network interface, but can be
changed with the <code>--bind-address</code> flag.</li>
</ul>
<p>Above mentioned parameters (<code>--secure-port</code> and <code>--bind-address</code>) allow you to configure network interface with secure port for Kubernetes API.
As stated before, if you don't specify any values:</p>
<blockquote>
<p>By default it would be default IP is first non-localhost network interface and 6443 port.</p>
</blockquote>
<p>Please note that:<br />
<code>--advertise-address</code> will be used by <code>kube-apiserver</code> to advertise this address for kubernetes controller which are responsible for preparing endpoints for <code>kubernetes.default.svc</code> (core <code>Service</code> responsible for communication between internal applications and the the API server). This Kubernetes Service VIP is configured for per-node load-balancing by kube-proxy.<br />
More information on <code>kubernetes.default.svc</code> and kubernetes controller can be found <a href="https://networkop.co.uk/post/2020-06-kubernetes-default/" rel="nofollow noreferrer">here</a>.</p>
<h3><a href="https://v1-16.docs.kubernetes.io/docs/concepts/architecture/master-node-communication/" rel="nofollow noreferrer">Cluster &lt;-&gt; Master communication</a></h3>
<blockquote>
<p>All communication paths from the cluster to the master terminate at the apiserver (none of the other master components are designed to expose remote services). In a typical deployment, the apiserver is configured to listen for remote connections on a secure HTTPS port (443)
The kubernetes service is configured with a virtual IP address that is redirected (via kube-proxy) to the HTTPS endpoint on the apiserver.</p>
</blockquote>
<blockquote>
<p>There are two primary communication paths from the master (apiserver) to the cluster. The first is from the apiserver to the kubelet process which runs on each node in the cluster. The second is from the apiserver to any node, pod, or service through the apiserver’s proxy functionality.</p>
</blockquote>
<p>Additionally, you can find out more about communication within the cluster by reading <a href="https://v1-16.docs.kubernetes.io/docs/concepts/architecture/master-node-communication/" rel="nofollow noreferrer">master-node-communication</a> and <a href="https://kubernetes.io/docs/concepts/architecture/control-plane-node-communication/" rel="nofollow noreferrer">control-plane-node-communication</a>.</p>
