kubeadm: avoid requiring a CA key during kubeconfig expiration checks

[neolit123]

What type of PR is this?

/kind bug

What this PR does / why we need it:

When the "kubeadm certs check-expiration" command is used and
if the ca.key is not present, regular on disk certificate reads
pass fine, but fail for kubeconfig files. The reason for the
failure is that reading of kubeconfig files currently
requires reading both the CA key and cert from disk. Reading the CA
is done to ensure that the CA cert in the kubeconfig is not out of date
during renewal.

Instead of requiring both a CA key and cert to be read, only read
the CA cert from disk, as only the cert is needed for reading kubeconfig files.

This fixes printing the cert expiration table even if the ca.key
is missing on a host (i.e. the CA is considered external).

Which issue(s) this PR fixes:

xref kubernetes/kubeadm#2618

Special notes for your reviewer:

based on this bug i don't think the command worked before without ca.key

Does this PR introduce a user-facing change?

kubeadm: allow the "certs check-expiration" command to not require the existence of the cluster CA key (ca.key file) when checking the expiration of managed certificates in kubeconfig files.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[neolit123]

/priority important-longterm
/triage accepted

[neolit123]

/sig cluster-lifecycle
/area kubeadm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: neolit123

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cmd/kubeadm/OWNERS [neolit123]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[neolit123]

note, this (and the len(caCerts) != 1 check) is already an assumption in a number of places - e.g

kubernetes/cmd/kubeadm/app/phases/certs/renewal/readwriter.go

Line 89 in 847b2e1

return certs[0], nil

and applies to CA certs and server/client certs.

[pacoxu]

[root@daocloud ~]# mv /root/paco/pki/ca.key ~/
[root@daocloud ~]# kubeadm certs check-expiration  --cert-dir /root/paco/pki
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration

failure loading ca certificate authority: failed to load key: couldn't load the private key file /root/paco/pki/ca.key: open /root/paco/pki/ca.key: no such file or directory
To see the stack trace of this error execute with --v=5 or higher
[root@daocloud ~]#
[root@daocloud ~]# ./kubeadm certs check-expiration  --cert-dir /root/paco/pki
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[check-expiration] Error reading configuration from the Cluster. Falling back to default configuration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Nov 30, 2022 06:38 UTC   357d                                    yes
apiserver                  Nov 30, 2022 06:38 UTC   357d            ca                      yes
apiserver-etcd-client      Nov 30, 2022 06:38 UTC   357d            etcd-ca                 no
apiserver-kubelet-client   Nov 30, 2022 06:38 UTC   357d            ca                      yes
controller-manager.conf    Nov 30, 2022 06:38 UTC   357d                                    yes
etcd-healthcheck-client    Nov 30, 2022 06:38 UTC   357d            etcd-ca                 no
etcd-peer                  Nov 30, 2022 06:38 UTC   357d            etcd-ca                 no
etcd-server                Nov 30, 2022 06:38 UTC   357d            etcd-ca                 no
front-proxy-client         Nov 30, 2022 06:38 UTC   357d            front-proxy-ca          no
scheduler.conf             Nov 30, 2022 06:38 UTC   357d                                    yes

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Nov 28, 2031 06:38 UTC   9y              yes
etcd-ca                 Nov 28, 2031 06:38 UTC   9y              no
front-proxy-ca          Nov 28, 2031 06:38 UTC   9y              no
[root@daocloud ~]# ls /root/paco/pki
apiserver.crt              apiserver-kubelet-client.crt  front-proxy-ca.crt      sa.key
apiserver-etcd-client.crt  apiserver-kubelet-client.key  front-proxy-ca.key      sa.pub
apiserver-etcd-client.key  ca.crt                        front-proxy-client.crt
apiserver.key              etcd                          front-proxy-client.key

tested.
/lgtm