<p>I'm Trying to have a kubernetes cluster on aws and 
It's keep on failing while validation. using following command to update the cluster <code>kops update cluster cluster.foo.com --yes</code> and post running 
 this <code>kops validate cluster</code></p>

<pre><code>Using cluster from kubectl context: cluster.foo.com

Validating cluster cluster.api.com

INSTANCE GROUPS
NAME            ROLE    MACHINETYPE MIN MAX SUBNETS
master-eu-west-2a   Master  t2.medium   1   1   eu-west-2a
nodes           Node    t2.medium   2   2   eu-west-2a

NODE STATUS
NAME    ROLE    READY

VALIDATION ERRORS
KIND    NAME        MESSAGE
dns apiserver   Validation Failed

The dns-controller Kubernetes deployment has not updated the Kubernetes cluster's API DNS entry to the correct IP address.  The API DNS IP address is the placeholder address that kops creates: 203.0.113.123.  Please wait about 5-10 minutes for a master to start, dns-controller to launch, and DNS to propagate.  The protokube container and dns-controller deployment logs may contain more diagnostic information.  Etcd and the API DNS entries must be updated for a kops Kubernetes cluster to start.

Validation Failed
</code></pre>

<p>Please help in finding the root cause. <br> <br>1. I tried deleting and recreating multiple time but that did not helped me. <br>2.  Also tried manually placing the master public and private IP to route 53 but it break everything.</p>

<p>Since EC2 uses elastic IP address for public IP, each time you reboot master node it will receive a new public IP. It happens that KOPS does not pick up the new IP for the Kube API. For example, if your cluster name was <code>kube.mydomain.com</code>, the API DNS would be: <code>api.kube.mydomain.com</code> as you can see from Route53.</p>
<p>You'd see timeout error when you try to reach your cluster:</p>
<pre><code> $ kops rolling-update cluster
Using cluster from kubectl context: kube.mydomain.com

Unable to reach the kubernetes API.
Use --cloudonly to do a rolling-update without confirming progress with the k8s API


error listing nodes in cluster: Get &quot;https://api.kube.mydomain.com/api/v1/nodes&quot;: dial tcp 3.8.157.44:443: i/o timeout
$ 
</code></pre>
<p><strong>To fix this:</strong> Each time your EC2 master node receives a new public IP, you must manually update the public IP against DNS of <code>api.kube.mydomain.com</code> in Route53.</p>
<p>Also ensure that the master's private IP is updated against the DNS of <code>api.internal.kube.mydomain.com</code>. Otherwise, the nodes will got to network-unavailable state.</p>
