feat: create kubelet certificates on controlplane

[sergelogvinov]

This PR solves two problems:

1. kubelet can connect to the kube-api if node name was changed (dhcp tricks)
2. health check error message if rotate-server-certificates is true

Result

192.168.10.11   drwx------   212       Oct  4 20:26:35   .
192.168.10.11   -rw-------   850       Oct  4 20:24:12   kubelet-client-2021-10-04-20-24-12.pem
192.168.10.11   Lrwxrwxrwx   59        Oct  4 20:24:12   kubelet-client-current.pem -> /var/lib/kubelet/pki/kubelet-client-2021-10-04-20-24-12.pem
192.168.10.11   -rw-------   891       Oct  4 20:24:12   kubelet-server-2021-10-04-20-24-12.pem
192.168.10.11   -rw-------   919       Oct  4 20:26:35   kubelet-server-2021-10-04-20-26-35.pem
192.168.10.11   Lrwxrwxrwx   59        Oct  4 20:26:35   kubelet-server-current.pem -> /var/lib/kubelet/pki/kubelet-server-2021-10-04-20-26-35.pem

Second kubelet-server-2021-10-04-20-26-35.pem file was rotated by kubelet.

Acceptance

Please use the following checklist:

• you linked an issue (if applicable)
• you included tests (if applicable)
• you ran conformance (make conformance)
• you formatted your code (make fmt)
• you linted your code (make lint)
• you generated documentation (make docs)
• you ran unit-tests (make unit-tests)

See make help for a description of the available targets.

---

This change is 

[JAORMX]

evaluating certificates using Common Names is common... but discouraged. And some go libraries will actually migrate away from doing that. I suggest you instead rely on setting a SubjectAltName instead to avoid future problems.

[JAORMX]

Is there a proposal for this feature that describes the overall flow better? I'd like to know the plan for cert rotation which tends to be an issue

[smira]

Is there a proposal for this feature that describes the overall flow better? I'd like to know the plan for cert rotation which tends to be an issue

Right now Talos doesn't manage kubelet certificates, and kubelet rotates the certificates on its own.

We plan on taking over kubelet certificate management as part of bigger change to improve the node join security.

[JAORMX]

Is there a proposal for this feature that describes the overall flow better? I'd like to know the plan for cert rotation which tends to be an issue

Right now Talos doesn't manage kubelet certificates, and kubelet rotates the certificates on its own.

We plan on taking over kubelet certificate management as part of bigger change to improve the node join security.

that sounds like a good idea! I'd be happy to review if it helps.

[github-actions]

This PR is stale because it has been open 45 days with no activity.