144f6fc9c5
The change https://review.opendev.org/c/starlingx/config/+/838594 updated certificate api-version from cert-manager.io/v1alpha2 to cert-manager.io/v1. But did not make necessary changes to certificates specs to work with the new version. This change makes only the required changes to certificates specs to work with the new version: cert-manager.io/v1 The spec organization[] should now be subject:organizations[] See the difference here, https://cert-manager.io/v0.13-docs/reference/api-docs/#cert-manager.io/v1alpha2.Certificate and https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec The organization 'system:masters' in the admin.conf certificate is required to authorize the access for kubernetes-admin to cluster objects. This authorization is specified in the 'cluster-admin' clusterrolebinding. Without this change, all kubectl commands fail. In v1, unlike in v1alpha2, CN is ignored by TLS clients during authorization (https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec) if any subject alt name is set. My initial understanding here was that the CN field value is being ignored due to subject:organizations:['system:masters'] (in v1), as all the deployment and daemonset pods were failing after "system kube-rootca-pods-update --phase=trust-new-ca" (during rootCA update) with an authorization error for the user 'kube-apiserver-kubelet-client'. This forces the removal of organizations from the apiserver kubelet client certificate as all deployments and daemonset pods authenticate and authorize with the 'kube-apiserver-kubelet-client' user. Without 'system:nodes' in the kubelet client certificate, kube-scheduler and kube-controller-manager fail to authorize. More Info: https://kubernetes.io/docs/reference/access-authn-authz/node/ Test Plan: On CentOS AIO-SX: PASS: Manual kubernetes RootCA update successful PASS: Orchestrated kubernetes RootCA update successful. PASS: All deployments, daemonsets and pods running as expected after RootCA update. Closes-Bug: 1978365 Signed-off-by: Kaustubh Dhokte <kaustubh.dhokte@windriver.com> Change-Id: I767a70a07ab540510e4eb734cb4e282c9918840c