docker-kubernetes-tls-guide

One place where all of the kubernetes documentation (and this guide) is unclear is if we are running multiple API servers should we generate a kube-apiserver-server.pem and kube-apiserver-server-key.pem _per host_ (and add a SAN to the cert if we want to use an LB)? Or do we re-use the same one across all of the hosts. We've had some issues with the default service-account token being usable on one api server but not others when we generate a cert per (even though this seems like the most sensible setup). Basically it seems like the service account tokens are signed using the TLS public key so that the API servers can verify it later, but if all the api servers have a different key pair this won't work out well.

Not technically part of kubernetes but many of the services use etcd as backend and are passed the endpoints with option for certificates. I had been following this guide: http://blog.skrobul.com/securing_etcd_with_tls/ but realized it had some big gaps (like exposing Docker socket without security on all interfaces) and also that some services like podmaster don't seem to support the etcd TLS config file as mentioned here https://github.com/kubernetes/kubernetes/issues/15847 That seems like a big security issue to me if etcd is exposed (like in public cloud) and everything else relies on it to store data. any thought?