<p>I am trying reach my k8s master from my workstation. I can access the master from the LAN fine but not from my workstation. The error message is:</p>

<pre><code>% kubectl --context=employee-context get pods
Unable to connect to the server: x509: certificate is valid for 10.96.0.1, 10.161.233.80, not 114.215.201.87
</code></pre>

<p>How can I do to add 114.215.201.87 to the certificate? Do I need to remove my old cluster ca.crt, recreate it, restart whole cluster and then resign client certificate? I have deployed my cluster with kubeadm and I am not sure how to do these steps manually.</p>

<p>One option is to tell <code>kubectl</code> that you don't want the certificate to be validated. Obviously this brings up security issues but I guess you are only testing so here you go:</p>
<pre><code>kubectl --insecure-skip-tls-verify --context=employee-context get pods
</code></pre>
<p>The better option is to fix the certificate. Easiest if you reinitialize the cluster by running <code>kubeadm reset</code> on all nodes including the master and then do</p>
<pre><code>kubeadm init --apiserver-cert-extra-sans=114.215.201.87
</code></pre>
<p>It's also possible to fix that certificate without wiping everything, but that's a bit more tricky. Execute something like this on the master as root:</p>
<pre><code>rm /etc/kubernetes/pki/apiserver.*
kubeadm init phase certs all --apiserver-advertise-address=0.0.0.0 --apiserver-cert-extra-sans=10.161.233.80,114.215.201.87
docker rm `docker ps -q -f 'name=k8s_kube-apiserver*'`
systemctl restart kubelet
</code></pre>
