charts/kubeadm/templates/ClusterConfiguration.yaml

@@ -68,6 +68,8 @@ apiServer:
     api-audiences: "istio-ca"
     {{- end }}
     feature-gates: {{ include "kubeadm.featuregates" ( dict "return" "csv" "platform" .Values.platform ) | trimSuffix "," | quote }}
+    # for 1.21
+    # enable-admission-plugins: DenyServiceExternalIPs,NodeRestriction,EventRateLimit
     enable-admission-plugins: NodeRestriction,EventRateLimit
     # {{- if .Values.highAvailable }}
     # goaway-chance: ".001"

scripts/upgrade_120.sh

@@ -79,6 +79,7 @@ spec:
 
           echo "Patching ClusterConfig to re-create new etcd server certificates"
           yq w /etc/kubezero/kubeadm/templates/ClusterConfiguration.yaml etcd.local.serverCertSANs[+] $nodename > /etc/kubernetes/kubeadm-recert.yaml
+          yq w -i /etc/kubernetes/kubeadm-recert.yaml etcd.local.serverCertSANs[+] $nodename.$zone_name
           rm -f /etc/kubernetes/pki/etcd/server.*
           kubeadm init phase certs etcd-server --config=/etc/kubernetes/kubeadm-recert.yaml 2>/dev/null
           kill -s HUP $(ps -e | grep etcd | awk '{print $1}')