Additions to the master cert via a SANS entry should be possible.

[snoby]

It should be possible to add an additional DNS names to the SANS portion of the master cert. Besides the entry of the additional name via #2063 , we need for kops to handle distributing that updated cert to all the elements. Elements like the api servers and perhaps the worker nodes?

The use case is after a deployment where master and minions are private I change the API server ELB to an Internal Only ELB and then I only have access via a bastion / jump server. On that jump server I will be running nginx doing TCP proxying. This bastion is internal to my companies home network, so basically everything in kubernetes is internal except the ingress ELB.

Tagging Chris because he wanted to be tagged and Kris because we had talked about it in the past.
@chrislovecnm @kris-nova @justinsb

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle rotten
/remove-lifecycle stale

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close