Fix duplicate -addext when generating certificates with admission-controller/gencerts.sh

[raywainman]

What type of PR is this?

/kind bug

What this PR does / why we need it:

The autoscaler/vertical-pod-autoscaler/pkg/admission-controller/gencerts.sh script fails with the following error:

Generating certs for the VPA Admission Controller in /tmp/vpa-certs.
req: Skipping unknown subject name attribute "/CN"
Error adding extensions defined via -addext
40C7A2C93F7F0000:error:0580008C:x509 certificate routines:X509at_add1_attr:duplicate attribute:../crypto/x509/x509_att.c:86:

This is because

autoscaler/vertical-pod-autoscaler/pkg/admission-controller/gencerts.sh

Line 54 in cf8c507

openssl req -new -key ${TMP_DIR}/serverKey.pem -out ${TMP_DIR}/server.csr -subj "/CN=vpa-webhook.kube-system.svc" -config ${TMP_DIR}/server.conf -addext "subjectAltName = DNS:vpa-webhook.kube-system.svc"

adds a -addext argument that duplicates what is already added in

autoscaler/vertical-pod-autoscaler/pkg/admission-controller/gencerts.sh

Line 38 in cf8c507

subjectAltName = DNS:vpa-webhook.kube-system.svc

.

Perhaps this used to work because openSSL ignored duplicate entries? However, in the latest version of OpenSSL I'm using (3.0.10) this causes an error and prevents the script from finishing.

Which issue(s) this PR fixes:

Part of #6113, this fix was needed to unblock release testing.

Special notes for your reviewer:

Does this PR introduce a user-facing change?

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

NONE

[jbartosik]

/lgtm
/approve

Should we cherry pick this to the 1.0 branch?

We'll have to release 1.0.1 for this to be useful and 1.1 will be triggered on 2023-12-05 by K8s 1.29 release so I'm not sure if we'll have capacity to do the release but there's little harm in cherrypicking.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jbartosik, raywainman

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• vertical-pod-autoscaler/OWNERS [jbartosik]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[raywainman]

/lgtm /approve

Should we cherry pick this to the 1.0 branch?

We'll have to release 1.0.1 for this to be useful and 1.1 will be triggered on 2023-12-05 by K8s 1.29 release so I'm not sure if we'll have capacity to do the release but there's little harm in cherrypicking.

Good call, sent #6174.