Before the CCM started initializing node addresses (IP addresses and Hostnames) asynchronously, the kubelet would read the addresses, and hostnames from the node or from the cloud before creating the TLS serving certs. This ensured that the TLS certs reflected the correct addresses.

Now that the asynchronous model is being followed for node initialization, the kubelet generates certs with a set of addresses that do not reflect the cloud initialized addresses for the node.

The order of node address initialization -> TLS cert creation should be preserved with the new asynchronous model as well