diff --git a/terraform-modules/openstack-kubernetes-infra/kubeconfig-extraction.tf b/terraform-modules/openstack-kubernetes-infra/kubeconfig-extraction.tf
index 7e3fafe..e1069d7 100644
--- a/terraform-modules/openstack-kubernetes-infra/kubeconfig-extraction.tf
+++ b/terraform-modules/openstack-kubernetes-infra/kubeconfig-extraction.tf
@@ -1,10 +1,16 @@
 resource "null_resource" "copy_kubeconfig" {
   depends_on = [openstack_compute_instance_v2.kubernetes_server, null_resource.kubernetes_server_provisioner]
 
+  # Re-fetch kubeconfig whenever the controller is replaced (new cluster CA/certs).
+  triggers = {
+    server_id  = openstack_compute_instance_v2.kubernetes_server.id
+    ip_address = local.controller_host_instance.ip_address
+  }
+
   provisioner "local-exec" {
     # Copy the kubeconfig file from the host to a local file using SCP.
     # Use ssh-keyscan to prevent interactive prompt on unknown host
-    # Use sed to replace the localhost address in the KUBECONFIG file with the actual IP adddress of the created VM. 
+    # Use sed to replace the localhost address in the KUBECONFIG file with the actual IP adddress of the created VM.
     command = <<EOT
 mkdir -p ${path.root}/.build/ && \
 ssh-keyscan -H ${local.controller_host_instance.ip_address} >> ${path.root}/.build/.known_hosts_cogstack && \
diff --git a/terraform-modules/openstack-kubernetes-infra/variables.tf b/terraform-modules/openstack-kubernetes-infra/variables.tf
index a548e91..1455a5a 100644
--- a/terraform-modules/openstack-kubernetes-infra/variables.tf
+++ b/terraform-modules/openstack-kubernetes-infra/variables.tf
@@ -98,7 +98,7 @@ check "controller_floating_ip_required_for_non_default_network" {
   assert {
     condition = (var.network == null
       || (var.network.name == "external_4003" && var.network.network_id == null)
-      || (length([for host in var.host_instances : host if host.is_controller == true && host.floating_ip.use_floating_ip == true]) == 1))
+    || (length([for host in var.host_instances : host if host.is_controller == true && host.floating_ip.use_floating_ip == true]) == 1))
     error_message = <<-EOT
 When using a non-default network, the controller host should have a floating IP in order to be accessible by the terraform agent
 EOT