How can I add an additional IP / hostname to my Kubernetes certificate?

Question

I've recently followed this guide to set up Kubernetes on my local Raspberry Pi cluster. I can access it fine on my LAN; however I'd like to be able to access it remotely as well. I've already set up port forwarding on my router, but when I try to connect from outside the LAN, I get a x509 certificate error indicating that the certificate is signed for my local 192.168 address but not for my home's IP. I could bypass this with the --insecure-skip-tls-verify options but I'd much rather have the certificate used simply incorporate my IP address. Only... I'm not fully sure how to do that, though I do have some ideas.

When I initially set things up with kubeadm init, should I have used the --apiserver-advertise-address option to specify my home IP? Would doing so have had any adverse effects (such as precluding my local/192.168 IP?). Ideally I'd like the certificate to be signed for both the internal and external IPs. Or is there some other option I should have given to kubeadm init? Secondly, now that it has been initialized, is there any way to regenerate the certificate and swap it out, or will I need to nuke the cluster?

To clarify, I don't have any certificate managers installed. I'm not talking about Ingress. I'm talking about the actual "root" certificate (for lack of a better term) that kubeadm generates when first installing the cluster, i.e. the one that lives at /etc/kubernetes/pki/apiserver.crt

Answer 1

To do this, you’ll first need your kubeadm configuration file. This creates a file named kubeadm.yaml:

kubectl -n kube-system get configmap kubeadm-config -o jsonpath='{.data.ClusterConfiguration}' > kubeadm.yaml

Now open the file in an editor, and find the certSANs list under the apiServer section. If it does not exist, you’ll need to add it; if so, you’ll just add another entry to that list. Example:

apiServer:
  certSANs:
  - "172.29.50.162"
  - "k8s.domain.com"
  - "other-k8s.domain.net"
  extraArgs:
    authorization-mode: Node,RBAC
  timeoutForControlPlane: 4m0s

Now move the old certificates to another folder, otherwise kubeadm will not recreate new ones:

mv /etc/kubernetes/pki/apiserver.{crt,key} ~

Use kubeadm to generate new apiserver certificates:

kubeadm init phase certs apiserver --config kubeadm.yaml

Now restart your kubeapiserver container:

1. Run docker ps | grep kube-apiserver | grep -v pause to get the container ID for the container running the Kubernetes API server
2. Run docker kill <containerID> to kill the container.
3. The Kubelet will automatically restart the container, which will pick up the new certificate.

If everything is working as expected, don't forget to update the kubeadm ConfigMap stored in the cluster, otherwise, future kubeadm upgrade will be lacking your new config:

If using Kubernetes < v1.15:

kubeadm config upload from-file --config kubeadm.yaml

For Kubernetes version >= v1.15:

kubeadm init phase upload-config kubeadm --config kubeadm.yaml

This article has a more complete guide on how to Adding a Name to the Kubernetes API Server Certificate

Answer 2

The answer given by @Eduardo Baitello is the correct answer for the vast majority of Kube installs. However I learned that if you've installed the MicroK8S snap install on Ubuntu the instructions are a little bit different. Per this issue, you'll need to update the /var/snap/microk8s/current/certs/csr.conf.template file, then run microk8s.stop and microk8s.start in succession.