[release-1.25] Use default address family when adding kubernetes service address to SAN list

[brandond]

Proposed Changes

Use default address family when adding kubernetes service address to SAN list

We were using the legacy ServiceCIDR, which is always IPv4 if one is configured. We should instead use the first CIDR, which determines the cluster's default address family.

For the same reason, don't prefer advertising the IPv4 node addresses if both IPv4 and IPv6 addresses are given, just use whatever's given first.

Types of Changes

Verification

• See linked issue
• On a dual-stack cluster with IPv6 preferred (given first in the CIDR list), check for the cluster service address in the apiserver cert: openssl x509 -noout -text /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt

Testing

Linked Issues

• [release-1.25] API Server certificate not signed with IPv6 service IP #6891

User-Facing Change

The apiserver advertised address and IP SAN entry are now set correctly on clusters that use IPv6 as the default IP family.

Further Comments