<p>I have microK8S cluster, and expose the API server at my domain. 
The <code>server.crt</code> and <code>server.key</code> in <code>/var/snap/microk8s/1079/certs</code> need to be replaced with the ones that include my domain.
Otherwise, as expected, i get the error: </p>

<p><code>Unable to connect to the server: x509: certificate is valid for kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster, kubernetes.default.svc.cluster.local, not mydonaim.com</code></p>

<p>With the help of cert-manager I have produced certificates and replaced them, my system works well. </p>

<p><strong>Problem:</strong> every time server is restarted, <code>server.crt</code> and <code>server.key</code> are generated again in 
<code>/var/snap/microk8s/1079/certs</code>. My custom certs are deleted, making API server unreachable remotely. 
How can I stop the system from doing that all the time? </p>

<p><strong>Workaround?</strong>
Should I place my certificates elsewhere and edit config files like <code>/var/snap/microk8s/1079/args/kube-controller-manager</code> with the path to those certificates? Are those config files auto-replaced as well? </p>

<h3>Cluster information:</h3>

<ul>
<li>Kubernetes version: 1.16.3 </li>
<li>Cloud being used: Bare metal, single-node</li>
<li>cluster Installation method: Ubuntu Server with Snaps </li>
<li>Host OS: Ubuntu 18.04.3 LTS</li>
</ul>

Vladimir Akopyan
<p>It looks like there is <a href="https://github.com/ubuntu/microk8s/issues/421#issuecomment-482105218" rel="nofollow noreferrer">an existing issue</a> that describes copying and modifying the <code>/var/snap/microk8s/current/certs/csr.conf.template</code> to include any extra IP or DNS entries for the generated certificates</p>
