// create self-signed cert+key with the fake server.LoopbackClientServerNameOverride and // let the server return it when the loopback client connects. certPem, keyPem, err := certutil.GenerateSelfSignedCertKey(server.LoopbackClientServerNameOverride, nil, nil) if err != nil {  return fmt.Errorf("failed to generate self-signed certificate for loopback connection: %v", err) } certProvider, err := dynamiccertificates.NewStaticSNICertKeyContent("self-signed loopback", certPem, keyPem, server.LoopbackClientServerNameOverride) if err != nil {  return fmt.Errorf("failed to generate self-signed certificate for loopback connection: %v", err) }
---
// GenerateSelfSignedCertKeyWithFixtures creates a self-signed certificate and key for the given host.// Host may be an IP or a DNS name. You may also specify additional subject alt names (either ip or dns names)// for the certificate.//// If fixtureDirectory is non-empty, it is a directory path which can contain pre-generated certs. The format is:// <host>_<ip>-<ip>_<alternateDNS>-<alternateDNS>.crt// <host>_<ip>-<ip>_<alternateDNS>-<alternateDNS>.key// Certs/keys not existing in that directory are created.func GenerateSelfSignedCertKeyWithFixtures(host string, alternateIPs []net.IP, alternateDNS []string, fixtureDirectory string) ([]byte, []byte, error) { validFrom := time.Now().Add(-time.Hour) // valid an hour earlier to avoid flakes due to clock skew maxAge := time.Hour * 24 * 365          // one year self-signed certs

# replace {Master_IP} with your master IP and 6443 with your apiserver portcurl --resolve apiserver-loopback-client:6443:{Master_IP} -k -v https://apiserver-loopback-client:6443/healthz
root@kind-control-plane:/# curl --resolve apiserver-loopback-client:6443:172.17.0.2 -k -v https://apiserver-loopback-client:6443/healthz* Added apiserver-loopback-client:6443:172.17.0.2 to DNS cache* Hostname apiserver-loopback-client was found in DNS cache*   Trying 172.17.0.2:6443...* TCP_NODELAY set* Connected to apiserver-loopback-client (172.17.0.2) port 6443 (#0)* ALPN, offering h2* ALPN, offering http/1.1* successfully set certificate verify locations:*   CAfile: none  CApath: /etc/ssl/certs* TLSv1.3 (OUT), TLS handshake, Client hello (1):* TLSv1.3 (IN), TLS handshake, Server hello (2):* TLSv1.2 (IN), TLS handshake, Certificate (11):* TLSv1.2 (IN), TLS handshake, Server key exchange (12):* TLSv1.2 (IN), TLS handshake, Request CERT (13):* TLSv1.2 (IN), TLS handshake, Server finished (14):* TLSv1.2 (OUT), TLS handshake, Certificate (11):* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):* TLSv1.2 (OUT), TLS handshake, Finished (20):* TLSv1.2 (IN), TLS handshake, Finished (20):* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256* ALPN, server accepted to use h2* Server certificate:*  subject: CN=apiserver-loopback-client@1577103676*  start date: Dec 23 11:21:16 2019 GMT*  expire date: Dec 22 11:21:16 2020 GMT*  issuer: CN=apiserver-loopback-client-ca@1577103676*  SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway.* Using HTTP2, server supports multi-use* Connection state changed (HTTP/2 confirmed)* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0* Using Stream ID: 1 (easy handle 0x55d565d9c1d0)> GET /healthz HTTP/2> Host: apiserver-loopback-client:6443> User-Agent: curl/7.65.3> Accept: */*> * Connection state changed (MAX_CONCURRENT_STREAMS == 250)!< HTTP/2 200 < cache-control: no-cache, private< content-type: text/plain; charset=utf-8< x-content-type-options: nosniff< content-length: 2< date: Wed, 23 Dec 2020 14:29:30 GMT< * Connection #0 to host apiserver-loopback-client left intact