<p>When deploying a Kubernetes cluster manually we use kubeadm,</p>

<p><pre>kubeadm init ...</pre></p>

<p>passing the parameter <pre>--apiserver-cert-extra-sans=&lt;FQDN&gt;</pre> to include the FQDN in the generated certificate.</p>

<p>What approach can we use to achieve the same affect using Kubespray/Ansible?</p>

<p>I thought it was <a href="https://github.com/kubernetes-incubator/kubespray/blob/v2.3.0/inventory/group_vars/k8s-cluster.yml#L176" rel="nofollow noreferrer"><code>supplementary_addresses_in_ssl_keys</code></a> but <a href="https://github.com/kubernetes-incubator/kubespray/blob/v2.3.0/roles/kubernetes/secrets/templates/openssl.conf.j2#L32" rel="nofollow noreferrer">seeing it used</a> demonstrates they really mean "IP address" and not the more generic address concept.</p>

<p>So I would suspect one of two paths: 1. update the <code>openssl.conf.j2</code> to distinguish between a <code>supplementary_address</code> which is an IP, versus a hostname; 2. cheat and make the <a href="https://github.com/kubernetes-incubator/kubespray/blob/v2.3.0/roles/kubernetes/secrets/templates/openssl.conf.j2#L15" rel="nofollow noreferrer"><code>kube-master</code> "hostnames"</a> in <a href="https://github.com/kubernetes-incubator/kubespray/blob/v2.3.0/inventory/inventory.example#L14-L15" rel="nofollow noreferrer">the inventory</a> match up with the actual SAN name you would like in the cert (since those identifiers in the inventory can be mapped to IP addresses via <a href="https://github.com/kubernetes-incubator/kubespray/blob/v2.3.0/inventory/inventory.example#L3" rel="nofollow noreferrer"><code>ansible_ssh_host</code></a> for the purposes of connecting to the Nodes)</p>

<p>Arguably the change to <code>openssl.conf.j2</code> should go upstream in a PR, because your request certainly seems like a common and reasonable one</p>
