<p>Situation:
The metrics-server deployment image is: <code>k8s.gcr.io/metrics-server/metrics-server:v0.4.2</code>
I have used <code>kops</code> tool to deploy a kubernetes cluster into one AWS account.</p>
<p>The error and reason why it is failing, fetched by
<code>kubectl -n kube-system logs metrics-server-bcc948649-dsnd6</code></p>
<pre><code> unable to fully scrape metrics: [unable to fully scrape metrics from node ip-10-33-47-106.eu-central-1.compute.internal: unable to fetch metrics from node ip-10-33-47-106.eu-central-1.compute.internal: Get &quot;https://10.33.47.106:10250/stats/summary?only_cpu_and_memory=true&quot;: x509: cannot validate certificate for 10.33.47.106 because it doesn't contain any IP SANs, unable to fully scrape metrics from node ip-10-33-50-109.eu-central-1.compute.internal: unable to fetch metrics from node ip-10-33-50-109.eu-central-1.compute.internal: Get &quot;https://10.33.50.109:10250/stats/summary?only_cpu_and_memory=true&quot;: x509: cannot validate certificate for 10.33.50.109 because it doesn't contain any IP SANs]

</code></pre>
<p>I can solve this easy by modifying the metrics-server deployment template, and adding the argument
<code>- --kubelet-insecure-tls</code> to the container args, but does not seem production solution.</p>
<p>What I want to ask and learn here is, how can I resolve this in the proper way without losing security ?</p>

<p>Kubelet certificates created by kOps contain only node hostname among their SANs, while metrics server deployed with default manifest is trying to use node private IPs for scraping.  Changing the <code>kubelet-preferred-address-types</code> argument resolves this issue:</p>
<pre><code>- --kubelet-preferred-address-types=Hostname
</code></pre>
