Repository: k3s-io/k3s
File: pkg/daemons/control/deps/deps.go (Go)

Code before:
	if err != nil {
		return err
	}

	altNames := &certutil.AltNames{
		DNSNames: []string{"kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc." + config.ClusterDomain},
	}

	addSANs(altNames, config.SANs)

	if _, err := createClientCertKey(regen, "kube-apiserver", nil,
		altNames, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		runtime.ServerCA, runtime.ServerCAKey,
		runtime.ServingKubeAPICert, runtime.ServingKubeAPIKey); err != nil {
		return err
	}

	if _, _, err := certutil.LoadOrGenerateKeyFile(runtime.ServingKubeletKey, regen); err != nil {
		return err
	}

	if _, err := createClientCertKey(regen, "kube-scheduler", nil,
		altNames, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		runtime.ServerCA, runtime.ServerCAKey,
		runtime.ServingKubeSchedulerCert, runtime.ServingKubeSchedulerKey); err != nil {
		return err
	}

	if _, err := createClientCertKey(regen, "kube-controller-manager", nil,
		altNames, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		runtime.ServerCA, runtime.ServerCAKey,
		runtime.ServingKubeControllerCert, runtime.ServingKubeControllerKey); err != nil {
		return err
	}

	return nil
}

func genETCDCerts(config *config.Control) error {
	runtime := config.Runtime
	regen, err := createSigningCertKey("etcd-server", runtime.ETCDServerCA, runtime.ETCDServerCAKey)
	if err != nil {
		return err
	}

	altNames := &certutil.AltNames{
		DNSNames: []string{"kine.sock"},
	}

	addSANs(altNames, config.SANs)


Review comment (security):
the `altNames` list here is set up for kube-apiserver, which isn't what these certs need. Looking at what is currently generated when rancher sets --cert-dir we have:
```
            X509v3 Subject Alternative Name:
                DNS:localhost, IP Address:127.0.0.1, IP Address:127.0.0.1
```

So this should be:
```suggestion
		[]string{"localhost", "127.0.0.1", "::1"}, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
```

Code after:
	if err != nil {
		return err
	}

	altNames := &certutil.AltNames{
		DNSNames: []string{"kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc." + config.ClusterDomain},
	}

	addSANs(altNames, config.SANs)

	if _, err := createClientCertKey(regen, "kube-apiserver", nil,
		altNames, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		runtime.ServerCA, runtime.ServerCAKey,
		runtime.ServingKubeAPICert, runtime.ServingKubeAPIKey); err != nil {
		return err
	}

	if _, _, err := certutil.LoadOrGenerateKeyFile(runtime.ServingKubeletKey, regen); err != nil {
		return err
	}

	altNames = &certutil.AltNames{}
	addSANs(altNames, []string{"localhost" ,"127.0.0.1", "::1"})

	if _, err := createClientCertKey(regen, "kube-scheduler", nil,
		altNames, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		runtime.ServerCA, runtime.ServerCAKey,
		runtime.ServingKubeSchedulerCert, runtime.ServingKubeSchedulerKey); err != nil {
		return err
	}

	if _, err := createClientCertKey(regen, "kube-controller-manager", nil,
		altNames, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		runtime.ServerCA, runtime.ServerCAKey,
		runtime.ServingKubeControllerCert, runtime.ServingKubeControllerKey); err != nil {
		return err
	}

	return nil
}

func genETCDCerts(config *config.Control) error {
	runtime := config.Runtime
	regen, err := createSigningCertKey("etcd-server", runtime.ETCDServerCA, runtime.ETCDServerCAKey)
	if err != nil {
		return err
	}

	altNames := &certutil.AltNames{
		DNSNames: []string{"kine.sock"},
	}