[Release-1.27] - rke2-cloud-controller-manager RB/CRBs subject lists grow without bound

[brandond]

Backport fix for rke2-cloud-controller-manager RB/CRBs subject lists grow without bound

• rke2-cloud-controller-manager RB/CRBs subject lists grow without bound #6272

[VestigeJ]

Reproduction from a 45 minute old rke2 cluster

$ kubectl -n kube-system get rolebinding rke2-cloud-controller-manager-authentication-reader -o yaml;kg clusterrolebinding rke2-cloud-controller-manager -n kube-system -o yaml;kg clusterrolebinding rke2-cloud-controller-manager-auth-delegator -n kube-system -o yaml;

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  creationTimestamp: "2024-07-31T17:25:30Z"
  labels:
    rke2.io/bootstrapping: rbac-defaults
  name: rke2-cloud-controller-manager-authentication-reader
  namespace: kube-system
  resourceVersion: "13648"
  uid: 3b9de0fc-8a9d-46ef-b0ea-b466b5110421
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: extension-apiserver-authentication-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  creationTimestamp: "2024-07-31T17:25:28Z"
  labels:
    rke2.io/bootstrapping: rbac-defaults
  name: rke2-cloud-controller-manager
  resourceVersion: "13647"
  uid: 3bfc916e-7a83-458d-857a-c173557084e9
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: rke2-cloud-controller-manager
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  creationTimestamp: "2024-07-31T17:25:28Z"
  labels:
    rke2.io/bootstrapping: rbac-defaults
  name: rke2-cloud-controller-manager-auth-delegator
  resourceVersion: "13646"
  uid: 29e38644-fc85-48a5-a3bb-a117ae10a09f
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system

[VestigeJ]

Validated using VERSION=v1.27.16-rc4+rke2r1

3 server 1 agent cluster multiple restarts basic configuration

$ kubectl -n kube-system get rolebinding rke2-cloud-controller-manager-authentication-reader -o yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  creationTimestamp: "2024-07-31T17:25:30Z"
  labels:
    rke2.io/bootstrapping: rbac-defaults
  name: rke2-cloud-controller-manager-authentication-reader
  namespace: kube-system
  resourceVersion: "241"
  uid: 3b9de0fc-8a9d-46ef-b0ea-b466b5110421
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: extension-apiserver-authentication-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system

$ kg clusterrolebinding rke2-cloud-controller-manager -n kube-system -o yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  creationTimestamp: "2024-07-31T17:25:28Z"
  labels:
    rke2.io/bootstrapping: rbac-defaults
  name: rke2-cloud-controller-manager
  resourceVersion: "233"
  uid: 3bfc916e-7a83-458d-857a-c173557084e9
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: rke2-cloud-controller-manager
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system

$ kg clusterrolebinding rke2-cloud-controller-manager-auth-delegator -n kube-system -o yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  creationTimestamp: "2024-07-31T17:25:28Z"
  labels:
    rke2.io/bootstrapping: rbac-defaults
  name: rke2-cloud-controller-manager-auth-delegator
  resourceVersion: "230"
  uid: 29e38644-fc85-48a5-a3bb-a117ae10a09f
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rke2-cloud-controller-manager
  namespace: kube-system