[Bug]: apiserver certificate is not recreating

[Mikopet]

Description

Hey!

I'm not sure about the terminologies here 100%, but my issue is that I've set up domains for an already provisioned cluster. (following the comments in kube.tf)

So now the cp.<domain> points correctly to the control plane nodes, and the kubeconfig generating properly with this domain.
I also did a server renaming with use_cluster_name_in_node_name = false, I don't know if this messed up things or not.

However, when I try to use kubectl:

Unable to connect to the server: tls: failed to verify certificate: x509: certificate is valid for control-plane-fsn1-lrd, control-plane-hel1-owt, control-plane-nbg1-rrz, kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, localhost, my-infra-control-plane-fsn1-rhn, my-infra-control-plane-hel1-edp, my-infra-control-plane-nbg1-czg, not cp.<domain>

To me it looks like the certificate is not regenerated(/renewed?) with the new domain set in kubeconfig_server_address = "cp.<domain>"

---

I'm trying to debug where it is located in the cluster, but none of the resources related to certs give me relevant information.

Is there any way from force recreate these certs without logging into the server and manually do that?

Kube.tf file

-

Screenshots

No response

Platform

linux

[Mikopet]

Now I did recreate the cluster, and the generated kubeconfig is referencing the cp domain.

However, issue is the same:

E0126 22:37:58.262750  126797 memcache.go:265] couldn't get current server API group list: Get "https://cp.my-domain.net:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate is valid for control-plane-fsn1-rfa, control-plane-hel1-pcz, control-plane-nbg1-qhv, kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, localhost, not cp.my-domain.net`

[Mikopet]

Ah, we realized there is a additional_tls_sans = ["cp.my-domain.net"], what is working as expected.

I still think it should account for kubeconfig_server_address = "cp.my-domain.net" too