Don't know if anyone encountered this before but here goes nothing. I have generated the controlplane certificate requests (csr) using kubeadm:
kubeadm alpha certs generate-csr --kubeconfig-dir /tmp/etc-k8s --cert-dir /tmp/etc-k8s/pki --config ./kubeadm.conf.yml
I provided a kubeadm config to pass SANs for ETCD and the kube-apiserver and they are reflected in the CSRs:
openssl req -in apiserver.csr -text -noout | grep X509 -A1
X509v3 Subject Alternative Name:
DNS:master-0, DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster.local, DNS:localhost, DNS:master-0, DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster, DNS:kubernetes.default.svc.cluster.local, IP Address:10.96.0.1, IP Address:192.168.6.10, IP Address:192.168.6.10, IP Address:10.96.0.10, IP Address:127.0.0.1
The issue is when i try to sign the certificate with an CA the SANs do not get passed on to the .crt file.
How can I make use of openssl extensions in such case since no openssl.cnf file is provided when the csr are generated?
If anyone can shed some light into this, I would be immensely thankful.