[release-1.20] kubernetes.default.svc not among SANs in Kubernetes API serving certificate

[fapatel1]

Pull through "kubernetes.default.svc not among SANs in Kubernetes API serving certificate" from k3s-io/k3s#3392 to release-1.21 branch

[ShylajaDevadiga]

Validated fix using v1.20.8-rc1+rke2r1
On new install

$ echo QUIT | openssl s_client -connect localhost:6443 2>/dev/null | openssl x509 -noout -text |grep DNS
                DNS:localhost, DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster.local, IP Address:10.43.0.1, IP Address:127.0.0.1, IP Address:172.31.5.149, IP Address:10.43.0.1

root@nginx-deployment-66b6c48dd5-jk9bv:/# curl --cacert /run/secrets/kubernetes.io/serviceaccount/ca.crt https://kubernetes.default.svc
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {
    
  },
  "status": "Failure",
  "message": "Unauthorized",
  "reason": "Unauthorized",
  "code": 401
}

On upgrade from v1.20.7+rke2r2 to v1.20.8-rc1+rke2r1
Before upgrade

ubuntu@ip-172-31-5-149:~$ echo QUIT | openssl s_client -connect localhost:6443 2>/dev/null | openssl x509 -noout -text |grep DNS
                DNS:localhost, DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc.cluster.local, IP Address:10.43.0.1, IP Address:127.0.0.1, IP Address:172.31.5.149, IP Address:10.43.0.1

After upgrade

ubuntu@ip-172-31-5-149:~$ echo QUIT | openssl s_client -connect localhost:6443 2>/dev/null | openssl x509 -noout -text |grep DNS
                DNS:localhost, DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster.local, IP Address:10.43.0.1, IP Address:127.0.0.1, IP Address:172.31.5.149, IP Address:10.43.0.1