Duplicated SANs in k8s-apiserver certificates

[atsikham]

What keywords did you search in kubeadm issues before filing this one?

tls, apiserver, certificate, extrasan, san, certsan, duplicate

Is this a BUG REPORT or FEATURE REQUEST?

BUG REPORT

Versions

kubeadm version (use kubeadm version):

kubeadm version: &version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.6", GitCommit:"dff82dc0de47299ab66c83c626e08b245ab19037", GitTreeState:"clean", BuildDate:"2020-07-15T16:56:34Z", GoVersion:"go1.13.9", Compiler:"gc", Platform:"linux/amd64"}

Environment:

• Kubernetes version (use kubectl version):

Client Version: version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.6", GitCommit:"dff82dc0de47299ab66c83c626e08b245ab19037", GitTreeState:"clean", BuildDate:"2020-07-15T16:58:53Z", GoVersion:"go1.13.9", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.6", GitCommit:"dff82dc0de47299ab66c83c626e08b245ab19037", GitTreeState:"clean", BuildDate:"2020-07-15T16:51:04Z", GoVersion:"go1.13.9", Compiler:"gc", Platform:"linux/amd64"}

• Cloud provider or hardware configuration:
  Azure, but reproduced in any environment
• OS (e.g. from /etc/os-release):
  Ubuntu 18.04.4 LTS, reproduced with other OS
• Kernel (e.g. uname -a):
  Linux 5.3.0-1028-azure #29~18.04.1-Ubuntu SMP Fri Jun 5 14:32:34 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

What happened?

When you add extra SANs for k8s apiserver in kubeadm config, if some value is in the list of SANs that kubeadm adds by default, this value will be duplicated then. It can be handled on the other side, but in this case kubeadm config is out of sync on all control plane nodes with kubeadm configmap. Important note that it does not brake anything.

What you expected to happen?

Kubeadm filters duplicated entries.

How to reproduce it (as minimally and precisely as possible)?

Add all control plane nodes addresses to apiServer.certSANs and deploy HA k8s cluster.

[neolit123]

fixed here kubernetes/kubernetes#92753 for 1.19
but cannot be backported to 1.18 and older since in k8s we only backport critical fixes.

/close

[k8s-ci-robot]

@neolit123: Closing this issue.

In response to this:

fixed here kubernetes/kubernetes#92753 for 1.19
but cannot be backported to 1.18 and older since in k8s we only backport critical fixes.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.