If the hostname has been changed:

spec:
  controlPlane:
    ingress:
      hostname: kubernetes-xxx.1k8sxxxk8s2.example.com:443
  networkProfile:
    certSANs:
    - kubernetes-xxx.1ksxxx.k8s2.example.com:443

Kamaji does not reconcile the certificates accordingly. However, I was able to remove the certificate manually, after which it was successfully reconciled:

k delete secret -n tenant-1k8sxxx kubernetes-xxx-api-server-certificate