diff --git a/staging/src/k8s.io/apiserver/pkg/server/config.go b/staging/src/k8s.io/apiserver/pkg/server/config.go
index cb7b4bd1cf9..2430f7f0588 100644
--- a/staging/src/k8s.io/apiserver/pkg/server/config.go
+++ b/staging/src/k8s.io/apiserver/pkg/server/config.go
@@ -346,6 +346,8 @@ type SecureServingInfo struct {
 	// A value of zero means to use the default provided by golang's HTTP/2 support.
 	HTTP2MaxStreamsPerConnection int
 
+	AdvertisePort int
+
 	// DisableHTTP2 indicates that http2 should not be enabled.
 	DisableHTTP2 bool
 }
@@ -1129,6 +1131,9 @@ func (s *SecureServingInfo) HostPort() (string, int, error) {
 	if err != nil {
 		return "", 0, fmt.Errorf("invalid non-numeric port %q", portStr)
 	}
+	if s.AdvertisePort != 0 {
+		port = s.AdvertisePort
+	}
 	return host, port, nil
 }
 
diff --git a/staging/src/k8s.io/apiserver/pkg/server/options/serving.go b/staging/src/k8s.io/apiserver/pkg/server/options/serving.go
index 842ab7ee0d1..eda85de7919 100644
--- a/staging/src/k8s.io/apiserver/pkg/server/options/serving.go
+++ b/staging/src/k8s.io/apiserver/pkg/server/options/serving.go
@@ -76,6 +76,9 @@ type SecureServingOptions struct {
 
 	// PermitAddressSharing controls if SO_REUSEADDR is used when binding the port.
 	PermitAddressSharing bool
+
+	// AdvertisePort allows overriding the default port used by the ap iserver
+	AdvertisePort int
 }
 
 type CertKey struct {
@@ -163,6 +166,8 @@ func (s *SecureServingOptions) AddFlags(fs *pflag.FlagSet) {
 	}
 	fs.IntVar(&s.BindPort, "secure-port", s.BindPort, desc)
 
+	fs.IntVar(&s.AdvertisePort, "advertise-port", s.AdvertisePort, "The port that will be advertised as kubernetes endpoints")
+
 	fs.StringVar(&s.ServerCert.CertDirectory, "cert-dir", s.ServerCert.CertDirectory, ""+
 		"The directory where the TLS certs are located. "+
 		"If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored.")
@@ -328,6 +333,8 @@ func (s *SecureServingOptions) ApplyTo(config **server.SecureServingInfo) error
 	}
 	c.SNICerts = namedTLSCerts
 
+	c.AdvertisePort = s.AdvertisePort
+
 	return nil
 }