To ensure the Controller Manager service is bound to secure loopback
address using a secure port,
set the RotateKubeletServerCertificate option to true
in the openshift-kube-controller-manager configmap on the master
node(s):
"extendedArguments": {
...
"secure-port": ["10257"],
...