<p>I have a running cluster with single master. A load balancer(kube.company.com) is configured to accept traffic at 443 and forwards it to the k8s master 6443.</p>
<p>I tried to change my ~/.kube/config <code>server</code> field definition from $masterIP:6443 to kube.company.com:443.</p>
<p>It throws the error x509: certificate signed by unknown authority.</p>
<p>I guess there should be some configuration that should be done to make this work, I just can't find it in the official docs</p>
<p>This is a bare metal setup using k8s version 1.21.2, containerd in RHEL env. The load balancer is nginx. Cluster is installed via kubeadm</p>

<p>When using <code>kubeadm</code> to deploy a cluster, if you want to use a custom name to access the <code>Kubernetes API Server</code>, you need to specify the <code>--apiserver-cert-extra-sans</code> flag of <code>kubeadm init</code>.</p>
<blockquote>
<p>Optional extra Subject Alternative Names (SANs) to use for the API Server serving certificate. Can be both IP addresses and DNS names.</p>
</blockquote>
<p>This is untested, but theoretically if you want to do this on an existing cluster, you should be able to log in <code>in every master node</code> and run this:</p>
<pre><code># remove current apiserver certificates
sudo rm /etc/kubernetes/pki/apiserver.*

# generate new certificates
sudo kubeadm init phase certs apiserver --apiserver-cert-extra-sans=&lt;your custom dns name here&gt;
</code></pre>
