Add FilterCN function to prevent SAN Stuffing

[brandond]

Proposed Changes

Wire up a node watch to collect addresses of server nodes, to prevent adding unauthorized SANs to the dynamiclistener cert.

Types of Changes

bugfix

Verification

See linked issue

Testing

Linked Issues

• dynamiclistener adds unwanted SubjectAlternativeName entries to certificate #7312

User-Facing Change

K3s's external apiserver listener now declines to add to its certificate any subject names not associated with the kubernetes apiserver service, server nodes, or values of the --tls-san option. This prevents the certificate's SAN list from being filled with unwanted entries.

Further Comments

[codecov]

Codecov Report

Patch coverage: 82.45% and project coverage change: +4.63% 🎉

Comparison is base (36645e7) 47.16% compared to head (388c90a) 51.79%.
Report is 14 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #8085      +/-   ##
==========================================
+ Coverage   47.16%   51.79%   +4.63%     
==========================================
  Files         143      144       +1     
  Lines       14561    14624      +63     
==========================================
+ Hits         6868     7575     +707     
+ Misses       6604     5858     -746     
- Partials     1089     1191     +102     

Flag	Coverage Δ
e2etests	49.57% <81.63%> (?)
inttests	44.49% <77.19%> (-0.05%)	⬇️
unittests	19.95% <0.00%> (+0.08%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Changed	Coverage Δ
pkg/cluster/cluster.go	40.00% <ø> (ø)
pkg/etcd/etcd.go	45.62% <ø> (+4.30%)	⬆️
pkg/etcd/member_controller.go	22.22% <50.00%> (-1.24%)	⬇️
pkg/etcd/metadata_controller.go	46.66% <50.00%> (+1.66%)	⬆️
pkg/server/secrets-encrypt.go	42.34% <50.00%> (+41.63%)	⬆️
pkg/cluster/address_controller.go	81.25% <81.25%> (ø)
pkg/cloudprovider/servicelb.go	62.42% <100.00%> (ø)
pkg/cluster/https.go	66.34% <100.00%> (+6.77%)	⬆️
pkg/secretsencrypt/controller.go	50.30% <100.00%> (+29.69%)	⬆️
pkg/server/server.go	58.45% <100.00%> (+1.71%)	⬆️

... and 40 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.