kube-apiserver-etcd-client shouldn't have O=system:masters

[nnlkcncff]

Versions

kubeadm version --output short
v1.27.3

kubectl version --short
Client Version: v1.27.3

# cloud provider: n/a

cat /etc/os-release
PRETTY_NAME="Ubuntu 23.04"

uname -a
Linux master-1 6.2.0-20-generic #20-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr  6 07:48:48 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

containerd --version
containerd github.com/containerd/containerd v1.7.2 0cae528dd6cb557f7201036e9f43420650207b58

# CNI: calico

What happened?

The kube-apiserver-etcd-client certificate is created as specified in the documentation, but this issue proved that this is not as it should be.

What you expected to happen?

The kube-apiserver-etcd-client certificate should be created without O=system:masters, because etcd doesn't take this into account.

How to reproduce it (as minimally and precisely as possible)?

kubeadm init

[SataQiu]

/assign
Will have a look.

[neolit123]

@SataQiu would like to also send the k/website change?

[SataQiu]

@SataQiu would like to also send the k/website change?

Yes, I will do it after this PR(kubernetes/kubernetes#120521) is merged.

[neolit123]

same issue for the apiserver-kubelet-client.crt
kubernetes/kubernetes#121837
kubernetes/website#43870