Add advertise-address to SANs before generating apiserver cert - #14516
Merged
brandond merged 1 commit intoAug 14, 2026
Merged
Conversation
Signed-off-by: somaz <genius5711@gmail.com>
somaz94
marked this pull request as ready for review
August 14, 2026 08:03
brandond
approved these changes
Aug 14, 2026
vitorsavian
approved these changes
Aug 14, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #14516 +/- ##
==========================================
+ Coverage 51.41% 51.50% +0.08%
==========================================
Files 197 197
Lines 15766 15766
==========================================
+ Hits 8106 8120 +14
+ Misses 6368 6359 -9
+ Partials 1292 1287 -5
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This was referenced Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed Changes
Move the advertise-address SAN append so it runs before
PrepareServer, which is what generates the apiserver serving certificate.The block sat 79 lines after
PrepareServer, so by the time the address was appended the certificate had already been issued without it. That is why--advertise-addressstopped showing up inserving-kube-apiserver.crt.On the concern raised in the issue about Tailscale: agent startup no longer changes
AdvertiseIPafter this point. Every assignment to it lives inpkg/cli/server/server.go(lines 179, 526, 537, 546, 551) and all of them complete beforePrepareServerat line 555. The VPN block that sets it from Tailscale is at line 518, also before. Outside this fileAdvertiseIPis only read, inpkg/daemons/control/server.go:230-231.vpn.GetInfoFromExecutor()reads fromexecutor.Get(), which #14000 made an explicit setup step that runs before anything else, so it does not depend onagent.Runhaving started.I also updated the comment, which described the old ordering constraint.
Types of Changes
Bugfix.
Verification
Start a server with an advertise address and check the cert:
After this change the address is present in the Subject Alternative Name list. The reporter ran the same check on v1.36.3-rc1+k3s1 and the grep found nothing there.
Testing
Added a case to the existing
--advertise-addressstartup integration test that checks the address landed in the apiserver serving cert SANs. It follows the same steps the issue reporter used.Ran the startup suite locally against a binary built from this branch:
The
when a server with different IPs is createdgroup passed, including the new spec. One unrelated spec (when a server with different data-dir is created) failed in my setup with a cert trust error, an artifact of running the suite in a container with a persistent/var/lib/ranchervolume rather than on a clean runner.Linked Issues
Issue: #14473
Related refactors: #14000, and commit fb658b4
User-Facing Change
Further Comments
I used Claude Code while preparing this PR, for the source audit of
AdvertiseIPassignments and for a first draft of the test case. I went through the change and ran the startup integration suite against a binary built from this branch before opening this.