[Release-1.28] - Incorrect warning message for expiring K3s CA certificates about k3s

[VestigeJ]

Reproduced using VERSION=v1.28.10+k3s1

Validated using COMMIT=7de7adb2e40ab18deb1fc30950e688f162c6dee3

$ sudo mkdir -p /var/lib/rancher/k3s/server/tls/etcd;
$ sudo openssl genrsa -out /var/lib/rancher/k3s/server/tls/root-ca.key 4096;
$ sudo openssl req -x509 -new -nodes -sha256 -days 360 -subj "/CN=k3s-root-ca@test" -key /var/lib/rancher/k3s/server/tls/root-ca.key -out /var/lib/rancher/k3s/server/tls/root-ca.pem;
$ curl -sL https://github.com/k3s-io/k3s/raw/master/contrib/util/generate-custom-ca-certs.sh | sudo bash -;
$ COMMIT=7de7adb2e40ab18deb1fc30950e688f162c6dee3
$ sudo INSTALL_K3S_COMMIT=$COMMIT INSTALL_K3S_EXEC=server ./install-k3s.sh

Results before fix in place showing 90 days expiry against a 365 day valid certificate

$ kg events --field-selector involvedObject.kind==Node

LAST SEEN   TYPE      REASON                           OBJECT                  MESSAGE
9m17s       Warning   CACertificateExpirationWarning   node/ip-ip   Certificate authority certificates require attention - check k3s documentation and begin planning rotation: certificate-authority/server-ca.crt: certificate CN=k3s-root-ca@test will expire within 90 days at 2025-05-30T18:59:06Z, certificate-authority/client-ca.crt: certificate CN=k3s-root-ca@test will expire within 90 days at 2025-05-30T18:59:06Z, certificate-authority/request-header-ca.crt: certificate CN=k3s-root-ca@test will expire within 90 days at 2025-05-30T18:59:06Z, certificate-authority/peer-ca.crt: certificate CN=k3s-root-ca@test will expire within 90 days at 2025-05-30T18:59:06Z, certificate-authority/server-ca.crt: certificate CN=k3s-root-ca@test will expire within 90 days at 2025-05-30T18:59:06Z

Attention to the correct days now being printed for the pre-baked certificates

$ kg events --field-selector involvedObject.kind==Node

LAST SEEN   TYPE      REASON                           OBJECT                  MESSAGE
90s         Warning   CACertificateExpirationWarning   node/ip-ip   Certificate authority certificates require attention - check k3s documentation and begin planning rotation: certificate-authority/server-ca.crt: certificate CN=k3s-root-ca@test will expire within 365 days at 2025-05-30T22:26:47Z, certificate-authority/client-ca.crt: certificate CN=k3s-root-ca@test will expire within 365 days at 2025-05-30T22:26:47Z, certificate-authority/request-header-ca.crt: certificate CN=k3s-root-ca@test will expire within 365 days at 2025-05-30T22:26:47Z, certificate-authority/peer-ca.crt: certificate CN=k3s-root-ca@test will expire within 365 days at 2025-05-30T22:26:47Z, certificate-authority/server-ca.crt: certificate CN=k3s-root-ca@test will expire within 365 days at 2025-05-30T22:26:47Z