kube-etcd-healthcheck-client certificate subject mismatch with the docs

[nnlkcncff]

Versions

kubeadm version --output short
v1.27.3

kubectl version --short
Client Version: v1.27.3

# cloud provider: n/a

cat /etc/os-release
PRETTY_NAME="Ubuntu 23.04"

uname -a
Linux master-1 6.2.0-20-generic #20-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr  6 07:48:48 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

containerd --version
containerd github.com/containerd/containerd v1.7.2 0cae528dd6cb557f7201036e9f43420650207b58

# CNI: calico

What happened?

After cluster provisioning I noticed that the kube-etcd-healthcheck-client certificate was not created as specified in the documentation.

cfssl certinfo -cert /etc/kubernetes/pki/etcd/healthcheck-client.crt
{
  "subject": {
    "common_name": "kube-etcd-healthcheck-client",
    "organization": "system:masters",
    "names": [
      "system:masters",
      "kube-etcd-healthcheck-client"
    ]
  },
  "issuer": {
    "common_name": "etcd-ca",
    "names": [
      "etcd-ca"
    ]
  },
  "serial_number": "9022477560793950297",
  "not_before": "2023-07-31T09:28:19Z",
  "not_after": "2024-07-30T09:28:19Z",
  "sigalg": "SHA256WithRSA",
  "authority_key_id": "C5:B1:A1:3E:36:CF:84:B9:A5:8B:A6:36:0B:F8:39:C1:8C:DC:09:F5",
  "subject_key_id": "",
  "pem": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n"
}

What you expected to happen?

According to the docs, it should not contain "organization": "system:masters" and "names": "system:masters".

How to reproduce it (as minimally and precisely as possible)?

Provision a cluster with:

kubeadm init --control-plane-endpoint... \
	--pod-network-cidr... \
	--upload-certs

[SataQiu]

/assign
thanks for your feedback @nnlkcncff
I'll check it soon.