<p>I've installed my kubernetes cluster (two nodes) with <a href="https://github.com/kubernetes-sigs/kubespray" rel="nofollow noreferrer">kubespray</a>. Now I have added an third node. And I get the error from kubelet server on the new node:</p>

<blockquote>
  <p>Failed to list *v1.Service: Get <a href="https://94.130.25.248:6443/api/v1/services?limit=500&amp;resourceVersion=0" rel="nofollow noreferrer">https://94.130.25.248:6443/api/v1/services?limit=500&amp;resourceVersion=0</a>: x509: certificate is valid for 10.233.0.1, 94.130.25.247, 94.130.25.247, 10.233.0.1, 127.0.0.1, 94.130.25.247, 144.76.14.131, not 94.130.25.248</p>
</blockquote>

<p>The IP 94.130.25.248 is the ip of new node. </p>

<p>I've found <a href="https://stackoverflow.com/questions/46360361/invalid-x509-certificate-for-kubernetes-master">this post</a>, where was wrote about recreating the apicert. But the new version of kubeadm (v1.13.1) don't have this option. </p>

<p>Also I've try to renew the certificates with command:</p>

<pre><code>kubeadm alpha certs renew all --config /etc/kubernetes/kubeadm-config.yaml
</code></pre>

<p>This command regenerate the certificates, but with the same ips and dns. </p>

<p>My kubeadmin-config.yml (certSANs):</p>

<pre><code>  certSANs:
  - kubernetes
  - kubernetes.default
  - kubernetes.default.svc
  - kubernetes.default.svc.cluster.local
  - 10.233.0.1
  - localhost
  - 127.0.0.1
  - heku1
  - heku4
  - heku2
  - 94.130.24.247
  - 144.76.14.131
  - 94.130.24.248
</code></pre>

<p>Can someone tell me how can I added the ip to apicert?</p>

de1m
<p>hm...
I've removed the apiserver.* and apiserver-kubelet-client.* and recreated this with command:</p>

<pre><code>kubeadm init phase certs apiserver --config=/etc/kubernetes/kubeadm-config.yaml
kubeadm init phase certs apiserver-kubelet-client --config=/etc/kubernetes/kubeadm-config.yaml
systemctl stop kubelet
delete the docker container with kubelet
systemctl restart kubelet
</code></pre>
