Change:
// give the kube api server an "identity" it can use to for request header auth // so that aggregated api servers can understand who the calling user is s.Authentication.RequestHeader.AllowedNames = []string{"ash", "misty", "brock"} <ins> // create private key signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) if err != nil { return result, err } </ins> // make a client certificate for the api server - common name has to match one of our defined names above <ins> serial, err := rand.Int(rand.Reader, new(big.Int).SetInt64(math.MaxInt64-1)) if err != nil { return result, err } serial = new(big.Int).Add(serial, big.NewInt(1)) </ins> tenThousandHoursLater := time.Now().Add(10_000 * time.Hour) <del> clientCrtOfAPIServer, signer, err := pkiutil.NewCertAndKey(proxySigningCert, proxySigningKey, &pkiutil.CertConfig{ Config: cert.Config{ </del> <ins> certTmpl := x509.Certificate{ Subject: pkix.Name{ </ins> CommonName: "misty", <del> Usages: []x509.ExtKeyUsage{ x509.ExtKeyUsageClientAuth, }, </del> }, <del> NotAfter:           &tenThousandHoursLater, PublicKeyAlgorithm: x509.ECDSA, }) </del> <ins> SerialNumber: serial, NotBefore:    proxySigningCert.NotBefore, NotAfter:     tenThousandHoursLater, KeyUsage:     x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature, ExtKeyUsage: []x509.ExtKeyUsage{ x509.ExtKeyUsageClientAuth, }, BasicConstraintsValid: true, } certDERBytes, err := x509.CreateCertificate(rand.Reader, &certTmpl, proxySigningCert, signer.Public(), proxySigningKey) </ins> if err != nil { return result, err } <del> if err := pkiutil.WriteCertAndKey(s.SecureServing.ServerCert.CertDirectory, "misty-crt", clientCrtOfAPIServer, signer); err != nil { </del> <ins> clientCrtOfAPIServer, err := x509.ParseCertificate(certDERBytes) if err != nil { </ins> return result, err } <ins> // write the cert to disk certificatePath := filepath.Join(s.SecureServing.ServerCert.CertDirectory, "misty-crt.crt") certBlock := pem.Block{ Type:  "CERTIFICATE", Bytes: clientCrtOfAPIServer.Raw, } certBytes := pem.EncodeToMemory(&certBlock) if err := cert.WriteCert(certificatePath, certBytes); err != nil { return result, err } // write the key to disk privateKeyPath := filepath.Join(s.SecureServing.ServerCert.CertDirectory, "misty-crt.key") encodedPrivateKey, err := keyutil.MarshalPrivateKeyToPEM(signer) if err != nil { return result, err } if err := keyutil.WriteKey(privateKeyPath, encodedPrivateKey); err != nil { return result, err } </ins> s.ProxyClientKeyFile = filepath.Join(s.SecureServing.ServerCert.CertDirectory, "misty-crt.key") s.ProxyClientCertFile = filepath.Join(s.SecureServing.ServerCert.CertDirectory, "misty-crt.crt")

Discussion:
found this by running tests on this PR: it's problematic for a couple of reasons: prevents kubeadm from moving out (eventually) there are no API guarantees in the given code/structs/functions in pkiutils the logic in cmd/kube- must be reworked to generate cert/key pair without using kubeadm. originally in pending fix PR
/sig api-machinery cluster-lifecycle architecture /area code-organization
The label(s) cannot be applied, because the repository doesn't have them. <detailsIn response to : /sig api-machinery sig-cluster-lifecycle architecture /area code-organization </details
/assign
cc
Please make sure to add an import restriction to prevent a regression in the future.
/triage accepted