title: Kubelet - x509: certificate is valid for 10.233.0.1 not for <IP>
body: <p>I've installed my kubernetes cluster (two nodes) with <a href="https://github.com/kubernetes-sigs/kubespray" rel="nofollow noreferrer">kubespray</a>. Now I have added an third node. And I get the error from kubelet server on the new node:</p>
  
  <blockquote>
    <p>Failed to list *v1.Service: Get <a href="https://94.130.25.248:6443/api/v1/services?limit=500&amp;resourceVersion=0" rel="nofollow noreferrer">https://94.130.25.248:6443/api/v1/services?limit=500&amp;resourceVersion=0</a>: x509: certificate is valid for 10.233.0.1, 94.130.25.247, 94.130.25.247, 10.233.0.1, 127.0.0.1, 94.130.25.247, 144.76.14.131, not 94.130.25.248</p>
  </blockquote>
  
  <p>The IP 94.130.25.248 is the ip of new node. </p>
  
  <p>I've found <a href="https://stackoverflow.com/questions/46360361/invalid-x509-certificate-for-kubernetes-master">this post</a>, where was wrote about recreating the apicert. But the new version of kubeadm (v1.13.1) don't have this option. </p>
  
  <p>Also I've try to renew the certificates with command:</p>
  
  <pre><code>kubeadm alpha certs renew all --config /etc/kubernetes/kubeadm-config.yaml
  </code></pre>
  
  <p>This command regenerate the certificates, but with the same ips and dns. </p>
  
  <p>My kubeadmin-config.yml (certSANs):</p>
  
  <pre><code>  certSANs:
    - kubernetes
    - kubernetes.default
    - kubernetes.default.svc
    - kubernetes.default.svc.cluster.local
    - 10.233.0.1
    - localhost
    - 127.0.0.1
    - heku1
    - heku4
    - heku2
    - 94.130.24.247
    - 144.76.14.131
    - 94.130.24.248
  </code></pre>
  
  <p>Can someone tell me how can I added the ip to apicert?</p>