[v1.29.3+k3s1] Certificate rotation on k3s-agent fails to include sans addressing, causing api requests via kubectl to potentially fail if kube-vip is in use about k3s

[brandond]

--tls-san is not a valid agent flag, nor does it affect the kubelet's serving certificate. That flag only affects the TLS SANs on the supervisor/apiserver certifcate. The kubelet's serving certificate is only valid for a specific list of things: the node's hostname, the node's private IP, and the node's external IP. There is intentionally not any way to inject additional addresses that the kubelet's serving certificate is valid for.

E0618 19:47:32.196663 14962 memcache.go:265] couldn't get current server API group list: Get "https://192.168.0.102:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate is valid for 127.0.0.1, 192.168.0.52, not 192.168.0.102
I therefore check /var/lib/rancher/k3s/agent/serving-kubelet.crt

Why are you looking at the kubelet's certificate? That is for the kubelet, which listens on port 10250. That has nothing to do with the supervisor/apiserver certificate that is present on port 6443.