Regenerate apiserver.crt when APIEndpoint.AlternativeNames has something new

Signed-off-by: Artiom Diomin <artiom@kubermatic.com>

Author: kron4eg

pkg/certificate/ca.go

@@ -29,11 +29,12 @@ import (
 )
 
 const (
-	KubernetesCACertPath = "/etc/kubernetes/pki/ca.crt"
-	KubernetesCAKeyPath  = "/etc/kubernetes/pki/ca.key"
+	KubernetesAPIServerPath = "/etc/kubernetes/pki/apiserver.crt"
+	KubernetesCACertPath    = "/etc/kubernetes/pki/ca.crt"
+	KubernetesCAKeyPath     = "/etc/kubernetes/pki/ca.key"
 )
 
-func kubernetesPKIFiles() []string {
+func kubernetesPKICAFiles() []string {
 	return []string{
 		KubernetesCACertPath,
 		KubernetesCAKeyPath,
@@ -49,7 +50,7 @@ func kubernetesPKIFiles() []string {
 func DownloadKubePKI(s *state.State, _ *kubeoneapi.HostConfig, _ executor.Interface) error {
 	sshfs := s.Runner.NewFS()
 
-	for _, fname := range kubernetesPKIFiles() {
+	for _, fname := range kubernetesPKICAFiles() {
 		buf, err := fs.ReadFile(sshfs, fname)
 		if err != nil {
 			return err
@@ -74,13 +75,13 @@ func DownloadKubePKI(s *state.State, _ *kubeoneapi.HostConfig, _ executor.Interf
 func UploadKubePKI(s *state.State, _ *kubeoneapi.HostConfig, _ executor.Interface) error {
 	sshfs := s.Runner.NewFS()
 
-	for _, fname := range kubernetesPKIFiles() {
+	for _, fname := range kubernetesPKICAFiles() {
 		buf, found := s.Configuration.KubernetesPKI[fname]
 		if !found {
-			return fmt.Errorf("file %q found found in PKI", fname)
+			return fmt.Errorf("file %q not found in PKI", fname)
 		}
 
-		if err := sshfs.MkdirAll(path.Dir(fname), 0700); err != nil {
+		if err := sshfs.MkdirAll(path.Dir(fname), 0o700); err != nil {
 			return err
 		}
 
@@ -95,7 +96,7 @@ func UploadKubePKI(s *state.State, _ *kubeoneapi.HostConfig, _ executor.Interfac
 			return err
 		}
 
-		if err = fw.Chmod(0600); err != nil {
+		if err = fw.Chmod(0o600); err != nil {
 			return err
 		}
 

pkg/certificate/certificate.go

@@ -21,8 +21,11 @@ import (
 	"crypto/ecdsa"
 	"crypto/rsa"
 	"crypto/x509"
+	"encoding/pem"
 	"fmt"
+	"io/fs"
 	"os"
+	"slices"
 	"strings"
 	"time"
 
@@ -93,7 +96,7 @@ func CAKeyPair(config *configupload.Configuration) (crypto.Signer, *x509.Certifi
 
 func NewSignedKubernetesServiceTLSCert(name, namespace, domain string, caKey crypto.Signer, caCert *x509.Certificate) (map[string]string, error) {
 	serviceCommonName := strings.Join([]string{name, namespace, "svc"}, ".")
-	serviceFQDNCommonName := strings.Join([]string{serviceCommonName, domain, ""}, ".")
+	serviceFQDNCommonName := strings.Join([]string{serviceCommonName, domain}, ".")
 
 	altdnsNames := []string{
 		serviceFQDNCommonName,
@@ -140,7 +143,43 @@ func RenewAll(st *state.State) error {
 		logger := ctx.Logger.WithField("node", node.PublicAddress)
 		logger.Infoln("Renew certificates...")
 
-		_, _, err := ctx.Runner.RunRaw("sudo kubeadm certs renew all")
+		sshfs := ctx.Runner.NewFS()
+		apiserverCertFile, err := fs.ReadFile(sshfs, KubernetesAPIServerPath)
+		if err != nil {
+			return fail.SSH(err, "reading Kubernetes API server certificate")
+		}
+
+		apiserverPEM, _ := pem.Decode(apiserverCertFile)
+		if apiserverPEM == nil {
+			return fail.Runtime(fmt.Errorf("PEM block is empty"), "decoding Kubernetes API server certificate PEM")
+		}
+
+		apiserverCert, err := x509.ParseCertificate(apiserverPEM.Bytes)
+		if err != nil {
+			return fail.Runtime(err, "parsing Kubernetes API server certificate")
+		}
+
+		needToRecreateAPIServerCerts := false
+		for _, san := range ctx.Cluster.APIEndpoint.AlternativeNames {
+			if !slices.Contains(apiserverCert.DNSNames, san) {
+				needToRecreateAPIServerCerts = true
+			}
+		}
+
+		var certsCmd strings.Builder
+		if needToRecreateAPIServerCerts {
+			fmt.Fprintf(&certsCmd, "sudo rm %q\n", KubernetesAPIServerPath)
+			kubeadmInitAllCertsCmd, serr := scripts.KubeadmCertsAll(ctx.WorkDir, node.ID, ctx.KubeadmVerboseFlag())
+			if serr != nil {
+				return serr
+			}
+			certsCmd.WriteString(kubeadmInitAllCertsCmd)
+			certsCmd.WriteString("\n")
+		}
+
+		certsCmd.WriteString("sudo kubeadm certs renew all")
+
+		_, _, err = ctx.Runner.RunRaw(certsCmd.String())
 		if err != nil {
 			return fail.SSH(err, "renewing certificates")
 		}

pkg/scripts/kubeadm.go

@@ -39,7 +39,7 @@ var (
 		sudo find /etc/kubernetes/pki/ -name *.crt -exec chmod 600 {} \;
 	`)
 
-	kubeadmCertScriptTemplate = heredoc.Doc(`
+	kubeadmCertsAllScriptTemplate = heredoc.Doc(`
 		sudo kubeadm {{ .VERBOSE }} init phase certs all \
 			--config={{ .WORK_DIR }}/cfg/control_plane_full_{{ .NODE_ID }}.yaml
 		sudo find /etc/kubernetes/pki/ -name *.crt -exec chmod 600 {} \;
@@ -97,14 +97,14 @@ func KubeadmJoinWorker(workdir string, nodeID int, verboseFlag string) (string,
 	return result, fail.Runtime(err, "rendering kubeadmWorkerJoinScriptTemplate script")
 }
 
-func KubeadmCert(workdir string, nodeID int, verboseFlag string) (string, error) {
-	result, err := Render(kubeadmCertScriptTemplate, Data{
+func KubeadmCertsAll(workdir string, nodeID int, verboseFlag string) (string, error) {
+	result, err := Render(kubeadmCertsAllScriptTemplate, Data{
 		"WORK_DIR": workdir,
 		"NODE_ID":  nodeID,
 		"VERBOSE":  verboseFlag,
 	})
 
-	return result, fail.Runtime(err, "rendering kubeadmCertScriptTemplate script")
+	return result, fail.Runtime(err, "rendering kubeadmCertsAllScriptTemplate script")
 }
 
 func KubeadmInit(workdir string, nodeID int, verboseFlag, token, tokenTTL string, skipPhases string) (string, error) {

pkg/scripts/kubeadm_test.go

@@ -146,7 +146,7 @@ func TestKubeadmCert(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			got, err := KubeadmCert(tt.args.workdir, tt.args.nodeID, tt.args.verboseFlag)
+			got, err := KubeadmCertsAll(tt.args.workdir, tt.args.nodeID, tt.args.verboseFlag)
 			if !errors.Is(err, tt.err) {
 				t.Errorf("KubeadmCert() error = %v, wantErr %v", err, tt.err)
 

pkg/tasks/controlplane.go

@@ -55,7 +55,7 @@ func joinControlPlaneNodeInternal(s *state.State, node *kubeoneapi.HostConfig, c
 
 func kubeadmCertsExecutor(s *state.State, node *kubeoneapi.HostConfig, _ executor.Interface) error {
 	s.Logger.Infoln("Ensuring Certificates...")
-	cmd, err := scripts.KubeadmCert(s.WorkDir, node.ID, s.KubeadmVerboseFlag())
+	cmd, err := scripts.KubeadmCertsAll(s.WorkDir, node.ID, s.KubeadmVerboseFlag())
 	if err != nil {
 		return err
 	}