✨ Add CertificateValidityPeriod and CACertificateValidityPeriod to KubeadmConfig

api/bootstrap/kubeadm/v1beta1/conversion.go

@@ -329,3 +329,7 @@ func Convert_v1_Condition_To_v1beta1_Condition(in *metav1.Condition, out *cluste
 func Convert_v1beta1_Condition_To_v1_Condition(in *clusterv1beta1.Condition, out *metav1.Condition, s apimachineryconversion.Scope) error {
 	return clusterv1beta1.Convert_v1beta1_Condition_To_v1_Condition(in, out, s)
 }
+
+func Convert_v1beta2_ClusterConfiguration_To_v1beta1_ClusterConfiguration(in *bootstrapv1.ClusterConfiguration, out *ClusterConfiguration, s apimachineryconversion.Scope) error {
+	return autoConvert_v1beta2_ClusterConfiguration_To_v1beta1_ClusterConfiguration(in, out, s)
+}

api/bootstrap/kubeadm/v1beta1/conversion_test.go

@@ -126,6 +126,12 @@ func hubKubeadmConfigSpec(in *bootstrapv1.KubeadmConfigSpec, c randfill.Continue
 		}
 		in.JoinConfiguration.Timeouts.ControlPlaneComponentHealthCheckSeconds = initControlPlaneComponentHealthCheckSeconds
 	}
+
+	// Drop the field to avoid round trip errors as it exists only in v1beta2.
+	if in.ClusterConfiguration != nil {
+		in.ClusterConfiguration.CertificateValidityPeriodSeconds = nil
+		in.ClusterConfiguration.CACertificateValidityPeriodSeconds = nil
+	}
 }
 
 func spokeKubeadmConfigSpec(in *KubeadmConfigSpec, c randfill.Continue) {

api/bootstrap/kubeadm/v1beta2/kubeadm_types.go

@@ -172,6 +172,16 @@ type ClusterConfiguration struct {
 	// featureGates enabled by the user.
 	// +optional
 	FeatureGates map[string]bool `json:"featureGates,omitempty"`
+
+	// certificateValidityPeriodSeconds specifies the validity period for a non-CA certificate generated by kubeadm.
+	// Default value: 756,864,000 seconds -> 8760h (365 days * 24 hours = 1 year)
+	// +optional
+	CertificateValidityPeriodSeconds *int32 `json:"certificateValidityPeriodSeconds,omitempty"`
+
+	// caCertificateValidityPeriodSeconds specifies the validity period for a CA certificate generated by kubeadm.
+	// Default value: 756,864,000 seconds -> 87600h (365 days * 24 hours * 10 = 10 years)
+	// +optional
+	CACertificateValidityPeriodSeconds *int32 `json:"caCertificateValidityPeriodSeconds,omitempty"`
 }
 
 // ControlPlaneComponent holds settings common to control plane component of the cluster.

api/controlplane/kubeadm/v1beta1/conversion_test.go

@@ -104,6 +104,10 @@ func hubKubeadmConfigSpec(in *bootstrapv1.KubeadmConfigSpec, c randfill.Continue
 		}
 		in.JoinConfiguration.Timeouts.ControlPlaneComponentHealthCheckSeconds = initControlPlaneComponentHealthCheckSeconds
 	}
+	if in.ClusterConfiguration != nil {
+		in.ClusterConfiguration.CertificateValidityPeriodSeconds = nil
+		in.ClusterConfiguration.CACertificateValidityPeriodSeconds = nil
+	}
 }
 
 func hubBootstrapTokenString(in *bootstrapv1.BootstrapTokenString, _ randfill.Continue) {

bootstrap/kubeadm/types/upstreamv1beta3/conversion.go

@@ -241,3 +241,7 @@ func (src *ClusterConfiguration) GetAdditionalData(data *upstream.AdditionalData
 		data.ControlPlaneComponentHealthCheckSeconds = clusterv1.ConvertToSeconds(src.APIServer.TimeoutForControlPlane)
 	}
 }
+
+func Convert_v1beta2_ClusterConfiguration_To_upstreamv1beta3_ClusterConfiguration(in *bootstrapv1.ClusterConfiguration, out *ClusterConfiguration, s apimachineryconversion.Scope) error {
+	return autoConvert_v1beta2_ClusterConfiguration_To_upstreamv1beta3_ClusterConfiguration(in, out, s)
+}

bootstrap/kubeadm/types/upstreamv1beta3/conversion_test.go

@@ -80,6 +80,7 @@ func fuzzFuncs(_ runtimeserializer.CodecFactory) []interface{} {
 		hubControlPlaneComponentFuzzer,
 		hubLocalEtcdFuzzer,
 		hubNodeRegistrationOptionsFuzzer,
+		hubClusterConfigurationFuzzer,
 	}
 }
 
@@ -195,3 +196,10 @@ func spokeBootstrapToken(in *BootstrapToken, c randfill.Continue) {
 		in.TTL = ptr.To[metav1.Duration](metav1.Duration{Duration: time.Duration(c.Int31()) * time.Second})
 	}
 }
+
+func hubClusterConfigurationFuzzer(obj *bootstrapv1.ClusterConfiguration, c randfill.Continue) {
+	c.FillNoCustom(obj)
+
+	obj.CertificateValidityPeriodSeconds = nil
+	obj.CACertificateValidityPeriodSeconds = nil
+}

bootstrap/kubeadm/types/upstreamv1beta4/conversion.go

@@ -62,9 +62,13 @@ func Convert_upstreamv1beta4_ClusterConfiguration_To_v1beta2_ClusterConfiguratio
 	// Following fields do not exist in CABPK v1beta1 version:
 	// - Proxy (Not supported yet)
 	// - EncryptionAlgorithm (Not supported yet)
-	// - CertificateValidityPeriod (Not supported yet)
 	// - CACertificateValidityPeriod (Not supported yet)
-	return autoConvert_upstreamv1beta4_ClusterConfiguration_To_v1beta2_ClusterConfiguration(in, out, s)
+	if err := autoConvert_upstreamv1beta4_ClusterConfiguration_To_v1beta2_ClusterConfiguration(in, out, s); err != nil {
+		return err
+	}
+	out.CertificateValidityPeriodSeconds = clusterv1.ConvertToSeconds(in.CertificateValidityPeriod)
+	out.CACertificateValidityPeriodSeconds = clusterv1.ConvertToSeconds(in.CACertificateValidityPeriod)
+	return nil
 }
 
 func Convert_upstreamv1beta4_DNS_To_v1beta2_DNS(in *DNS, out *bootstrapv1.DNS, s apimachineryconversion.Scope) error {
@@ -220,3 +224,13 @@ func (src *ClusterConfiguration) GetAdditionalData(data *upstream.AdditionalData
 	// NOTE: for kubeadm v1beta4 types we are not reading ControlPlaneComponentHealthCheckSeconds into additional data
 	// because Cluster API types are aligned with kubeadm's v1beta4 API version.
 }
+
+// Convert_v1beta2_ClusterConfiguration_To_upstreamv1beta4_ClusterConfiguration is an autogenerated conversion function.
+func Convert_v1beta2_ClusterConfiguration_To_upstreamv1beta4_ClusterConfiguration(in *bootstrapv1.ClusterConfiguration, out *ClusterConfiguration, s apimachineryconversion.Scope) error {
+	if err := autoConvert_v1beta2_ClusterConfiguration_To_upstreamv1beta4_ClusterConfiguration(in, out, s); err != nil {
+		return err
+	}
+	out.CertificateValidityPeriod = clusterv1.ConvertFromSeconds(in.CertificateValidityPeriodSeconds)
+	out.CACertificateValidityPeriod = clusterv1.ConvertFromSeconds(in.CACertificateValidityPeriodSeconds)
+	return nil
+}

bootstrap/kubeadm/types/upstreamv1beta4/conversion_test.go

@@ -96,7 +96,11 @@ func spokeClusterConfigurationFuzzer(obj *ClusterConfiguration, c randfill.Conti
 	obj.Proxy = Proxy{}
 	obj.EncryptionAlgorithm = ""
 	obj.CACertificateValidityPeriod = nil
-	obj.CertificateValidityPeriod = nil
+
+	if obj.CertificateValidityPeriod != nil {
+		obj.CertificateValidityPeriod = ptr.To[metav1.Duration](metav1.Duration{Duration: time.Duration(c.Int31()) * time.Second})
+		obj.CACertificateValidityPeriod = ptr.To[metav1.Duration](metav1.Duration{Duration: time.Duration(c.Int31()) * time.Second})
+	}
 
 	// Drop the following fields as they have been removed in v1beta2, so we don't have to preserve them.
 	obj.Networking.ServiceSubnet = ""