Kubeadm ignores multiple service-account-issuer

[challapradyumna]

What keywords did you search in kubeadm issues before filing this one?

service-account-issuer

BUG REPORT

Versions

kubeadm version (use kubeadm version): 1.22.12

Environment:

• Kubernetes version (use kubectl version): 1.22.12
• Cloud provider or hardware configuration: AWS
• OS (e.g. from /etc/os-release): Ubuntu
• Kernel (e.g. uname -a): 4.4.0-1087-aws
• Container runtime (CRI) (e.g. containerd, cri-o): Docker
• Container networking plugin (CNI) (e.g. Calico, Cilium): Calico
• Others:

What happened?

Provided multiple service-account-issuer in ClusterConfiguration -> apiServer -> extraArgs
Only the last provided service-account-issuer is being added to the kube-apiserver.yaml manifest file.

What you expected to happen?

kube-apiserver.yaml manifest file should have multiple service-account-issuer flags. Since it is supported 1.22+

- --service-account-issuer=https://kubernetes.default.svc.cluster.local

How to reproduce it (as minimally and precisely as possible)?

Create a kind cluster with the following configuration:

# cluster.yaml
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
featureGates:
  ServiceAccountIssuerDiscovery: true
networking:
  apiServerPort: 6443
name: test
nodes:
- role: control-plane
  image: kindest/node:v1.22.9
  kubeadmConfigPatches:
  - |
    apiVersion: kubeadm.k8s.io/v1beta3
    kind: ClusterConfiguration
    apiServer:
      extraArgs:
        service-account-issuer: https://abc.s3.com
        service-account-issuer: https://kubernetes.default.svc.cluster.local
        service-account-signing-key-file: /etc/kubernetes/pki/sa.key
        service-account-key-file: /etc/kubernetes/pki/sa.pub
        api-audiences: sts.amazonaws.com,https://kubernetes.default.svc.cluster.local
    etcd:
      local:
          imageRepository: k8s.gcr.io
          imageTag: 3.5.4-0
          dataDir: /var/lib/etcd

kind create cluster --config=cluster.yaml

This function has to be updated - https://github.com/kubernetes/kubernetes/blob/95303390ac7c7bcc47306eede25644712127cdfb/cmd/kubeadm/app/phases/controlplane/manifests.go#L161

[neolit123]

known problem #1601

you can use patches instead of extra args
https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/control-plane-flags/#patches