USHIFT-6951: narrow kubelet serving CA bundle for metrics-server

add KubeletServingCAPath containing only kubelet-signer and
kube-csr-signer; use it instead of the broader KubeletClientCAPath

Signed-off-by: Jonathan H. Cope <jcope@redhat.com>

Author: copejon

pkg/cmd/init.go

@@ -371,6 +371,10 @@ func certSetup(cfg *config.Config) (*certchains.CertificateChains, error) {
 		[]string{"admin-kubeconfig-signer"},
 		[]string{"kubelet-signer"},
 		[]string{"kubelet-signer", "kube-csr-signer"},
+	).WithCABundle(
+		cryptomaterial.KubeletServingCAPath(certsDir),
+		[]string{"kubelet-signer"},
+		[]string{"kubelet-signer", "kube-csr-signer"},
 	).WithCABundle(
 		cryptomaterial.ServiceAccountTokenCABundlePath(certsDir),
 		[]string{"kube-apiserver-localhost-signer"},

pkg/components/metrics.go

@@ -98,7 +98,7 @@ func ProvisionMetricsServerCerts(ctx context.Context, cfg *config.Config) error
 		return fmt.Errorf("applying metrics-server client cert secret: %w", err)
 	}
 
-	caPEM, err := os.ReadFile(cryptomaterial.KubeletClientCAPath(certsDir))
+	caPEM, err := os.ReadFile(cryptomaterial.KubeletServingCAPath(certsDir))
 	if err != nil {
 		return err
 	}

pkg/util/cryptomaterial/certinfo.go

@@ -171,6 +171,10 @@ func KubeletClientCAPath(certsDir string) string {
 	return filepath.Join(certsDir, "ca-bundle", "kubelet-ca.crt")
 }
 
+func KubeletServingCAPath(certsDir string) string {
+	return filepath.Join(certsDir, "ca-bundle", "kubelet-serving-ca.crt")
+}
+
 func ServiceAccountTokenCABundlePath(certsDir string) string {
 	return filepath.Join(certsDir, "ca-bundle", "service-account-token-ca.crt")
 }