BUG: sealos cert generate wrong DNS altnames for HA etcd clusters

[dinoallo]

Sealos Version

v4.3.3 / main

How to reproduce the bug?

Steps to reproduce:

1. Create a cluster with multiple master nodes.
2. Run sealos cert on a master node
3. Log into any other master nodes.
4. openssl x509 -text -in /etc/kubernetes/pki/etcd/peer.crt -noout | less and we can see that the DNS altnames, specifically the hostname and the IP, are the ones for the node running the command.

What is the expected behavior?

The certificates for etcd are generated correctly with DNS altnames consisting of each node's hostname and IP.

What do you see instead?

It can be seen that the DNS altnames, specifically the hostname and the IP, are the ones for the node running the command.

Operating environment

- Sealos version: v4.3.3 / main
- Docker version:
- Kubernetes version:
- Operating system:
- Runtime environment:
- Cluster size:
- Additional information:

Additional information

If this issue happened, the first etcd service would complain that the other etcd services have wrong DNS altnames in their certificates, resulting in this etcd service restarting frequently. The cluster can be recovered by re-issuing the wrong etcd certificates(peer.crt, server.crt) on each node.

Step to recover the cluster:
(Do the following on each node affected)

1. Backup the old certificates
2. Remove the wrong etcd certificates, i.e. peer.crt, server.crt
3. Create a ClusterConfiguration like this:

# config.yaml
apiVersion: "kubeadm.k8s.io/v1beta3"
kind: ClusterConfiguration
etcd:
    local:
        serverCertSANs:
        - "<your-node-ip>"
        - "<your-node-hostname>"
        peerCertSANs:
        - "<your-node-ip>"
        - "<your-node-hostname>"

5. Run kubeadm init phase certs etcd-peer --config config.yaml and kubeadm init phase certs etcd-server --config config.yaml to generate new certificates.

[dinoallo]

cross reference: #3708