kubernetes.default.svc not among SANs in Kubernetes API serving certificate

[fapatel1]

Pull through "kubernetes.default.svc not among SANs in Kubernetes API serving certificate" from k3s-io/k3s#3392 to master branch

[cjellick]

This needs to be fixed and in on 1.20 and 1.21, both k3s and rke2. make sure all the issues line up properly.

[ShylajaDevadiga]

Validated using rc, v1.21.2-rc1+rke2r1
Reproduced in v1.20.7+rke2r2

$ echo QUIT | openssl s_client -connect localhost:6443 2>/dev/null | openssl x509 -noout -text |grep DNS
                DNS:localhost, DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc.cluster.local

After the fix using v1.21.2-rc1+rke2r1

$ echo QUIT | openssl s_client -connect localhost:6443 2>/dev/null | openssl x509 -noout -text |grep DNS
                DNS:localhost, DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster.local

From within the pod

root@nginx-deployment-66b6c48dd5-shk8r:/# curl --cacert /run/secrets/kubernetes.io/serviceaccount/ca.crt https://kubernetes.default
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {
    
  },
  "status": "Failure",
  "message": "Unauthorized",
  "reason": "Unauthorized",
  "code": 401
}