<p>I have been creating an amazon AMI with kubernetes installed on it to use as a worker node in EKS, I install the kubelet binary from the amazon-eks s3 bucket.</p>

<p>After upgrading from k8s version 1.10.11 to 1.11.5 I noticed a difference in the x509 certificate that is generated when installing kubelet.</p>

<p>If I jump onto one of the worker nodes with 1.10.11 installed and run this command <code>openssl s_client -connect localhost:10250 2&gt;/dev/null | openssl x509 -noout -text</code> I get the following output for <code>X509v3 Subject Alternative Name</code>:</p>

<pre><code>DNS:ip-&lt;my-ip&gt;.eu-central-1.compute.internal, DNS:ip-&lt;my-ip&gt;, IP Address:&lt;my-ip&gt;
</code></pre>

<p>whereas, if I run the same command on a worker node with 1.11.5 installed I get the following output for <code>X509v3 Subject Alternative Name</code>:</p>

<pre><code>DNS:ip-&lt;my-ip&gt;
</code></pre>

<p>The only change between the two nodes is the version of kubernetes installed.</p>

<p>Am I missing anything that is now required as of version 1.11.x to set the additional Subject Alternative Names as seemed to be previously done in v1.10.x? I require the IP address to be set in the certificate in the format <code>IP Address:&lt;my-ip&gt;</code> which I was getting for free in version 1.10.</p>

<p>FYI I am running kubelet with the following args:</p>

<pre><code>ExecStart=/usr/bin/kubelet \
  --address=0.0.0.0 \
  --authentication-token-webhook \
  --authorization-mode=Webhook \
  --allow-privileged=true \
  --cloud-provider=aws \
  --cluster-dns=DNS_CLUSTER_IP \
  --cluster-domain=cluster.local \
  --cni-bin-dir=/opt/cni/bin \
  --cni-conf-dir=/etc/cni/net.d \
  --container-runtime=docker \
  --max-pods=MAX_PODS \
  --node-ip=INTERNAL_IP \
  --network-plugin=cni \
  --pod-infra-container-image=602401143452.dkr.ecr.REGION.amazonaws.com/eks/pause-amd64:3.1 \
  --cgroup-driver=cgroupfs \
  --register-node=true \
  --kubeconfig=/var/lib/kubelet/kubeconfig \
  --feature-gates=RotateKubeletServerCertificate=true \
  --anonymous-auth=false \
  --client-ca-file=CLIENT_CA_FILE \
  --node-labels=env=NODE_LABEL
</code></pre>

<p>As far as handling the certificates there are not Kubernetes specific differences between <code>1.10.11</code> and <code>1.11.5</code>. It might be related to specific <a href="https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html" rel="nofollow noreferrer">EKS AMI</a> for the nodes that you are using (make sure they are matching)</p>

<p>If not you can manually <a href="https://kubernetes.io/docs/concepts/cluster-administration/certificates/" rel="nofollow noreferrer">create</a> the certificates for the kubelet using the same CA as the one in your Kubernetes master. For example:</p>

<p><strong><em>easyrsa</em></strong></p>

<pre><code>./easyrsa --subject-alt-name="IP:${MASTER_IP},"\
"IP:-&lt;my-ip&gt;,"\
"DNS:ip-&lt;my-ip&gt;.eu-central-1.compute.internal,"\
"DNS:ip-&lt;my-ip&gt;,"\
--days=10000 \
build-server-full server nopass
</code></pre>

<p><strong><em>openssl</em></strong></p>

<p>Config (csr.conf):</p>

<pre><code>[ req ]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
C = &lt;country&gt;
ST = &lt;state&gt;
L = &lt;city&gt;
O = &lt;organization&gt;
OU = &lt;organization unit&gt;
CN = &lt;my-ip&gt;

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = ip-&lt;my-ip&gt;.eu-central-1.compute.internal
DNS.2 = ip-&lt;my-ip&gt;
IP.1 = &lt;my-ip&gt;

[ v3_ext ]
authorityKeyIdentifier=keyid,issuer:always
basicConstraints=CA:FALSE
keyUsage=keyEncipherment,dataEncipherment
extendedKeyUsage=serverAuth,clientAuth
subjectAltName=@alt_names
</code></pre>

<p>Create CSR:</p>

<pre><code>$ openssl req -new -key server.key -out server.csr -config csr.conf
</code></pre>

<p>Create certificate:</p>

<pre><code>$ openssl x509 -req -in server.csr -CA cluster-ca.crt -CAkey cluster-ca.key \
-CAcreateserial -out server.crt -days 10000 \
-extensions v3_ext -extfile csr.conf
</code></pre>

<p><strong><em>cfssl</em></strong></p>

<p>In a similar fashion you can use <a href="https://github.com/cloudflare/cfssl" rel="nofollow noreferrer">cfssl</a>, described <a href="https://kubernetes.io/docs/concepts/cluster-administration/certificates/#cfssl" rel="nofollow noreferrer">here</a>.</p>
