<p>I have a bare metal Kubernete cluster running behind a firewall. When trying to connect to it from my local machine (on the other side of the firewall) the connection do not work because the certificate is not correct. <br>
The problem is the following. The cluster runs inside a network behind the firewall and the certificate was created using the master IP. But when I use this same certificate trying to connect from outside the internal network, I use a differente IP. At this point the error message appears, saying that the certificate is different from the address I am trying to connect.</p>

<p>The IP that I use to access the cluster is different from the actual cluster IP displayed here:
<a href="https://i.stack.imgur.com/MwMDb.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/MwMDb.png" alt="enter image description here"></a>
<br>
How can I fix it? Is it possible to create another certificate with a different IP in my master node?</p>

Rodolfo
<p>You can add new Subject Alternative Names (SANs) to your Kubernetes API server certificate with the following steps.</p>

<p>First need your <code>kubeadm</code> configuration file. This creates a file named <code>kubeadm.yaml</code>:</p>

<p><code>kubectl -n kube-system get configmap kubeadm-config -o jsonpath='{.data.ClusterConfiguration}' &gt; kubeadm.yaml</code></p>

<p>Now open the file in an editor, and find the <code>certSANs</code> list under the <code>apiServer</code> section. If it does not exist, you’ll need to add it; if so, you’ll just add another entry to that list. Example:</p>

<pre><code>apiServer:
  certSANs:
  - "172.29.50.162"
  - "k8s.domain.com"
  - "other-k8s.domain.net"
  extraArgs:
    authorization-mode: Node,RBAC
  timeoutForControlPlane: 4m0s
</code></pre>

<p>Now move the old certificates to another folder, otherwise <code>kubeadm</code> will not recreate new ones:</p>

<p><code>mv /etc/kubernetes/pki/apiserver.{crt,key} ~</code> </p>

<p>Use <code>kubeadm</code> to generate new apiserver certificates:</p>

<p><code>kubeadm init phase certs apiserver --config kubeadm.yaml</code></p>

<p>Now restart your <em>kubeapiserver</em> container:</p>

<ol>
<li>Run <code>docker ps | grep kube-apiserver | grep -v pause</code> to get the
container ID for the container running the Kubernetes API server</li>
<li>Run <code>docker kill &lt;containerID&gt;</code> to kill the container.</li>
<li><em>The Kubelet will automatically restart the container, which will pick up the new certificate.</em></li>
</ol>

<p>If everything is working as expected, don't forget to update the <code>kubeadm</code> ConfigMap stored in the cluster, otherwise, future <code>kubeadm</code> upgrade will be lacking your new config:</p>

<p><code>kubeadm config upload from-file --config kubeadm.yaml</code></p>

<p><em>This article has a more complete guide on how to <a href="https://blog.scottlowe.org/2019/07/30/adding-a-name-to-kubernetes-api-server-certificate/" rel="nofollow noreferrer">Adding a Name to the Kubernetes API Server Certificate</a></em></p>
