failing e2e test: dryrun-latest

[neolit123]

failing since yesterday
https://testgrid.k8s.io/sig-cluster-lifecycle-kubeadm#kubeadm-kinder-dryrun-latest

https://storage.googleapis.com/kubernetes-ci-logs/logs/ci-kubernetes-e2e-kubeadm-kinder-dryrun-latest/1924882460127006720/build-log.txt

failed to verify JWS signature of received cluster info object, can't trust this API Server
k8s.io/kubernetes/cmd/kubeadm/app/discovery/token.validateClusterInfoToken
	k8s.io/kubernetes/cmd/kubeadm/app/discovery/token/token.go:185
k8s.io/kubernetes/cmd/kubeadm/app/discovery/token.retrieveValidatedConfigInfo
	k8s.io/kubernetes/cmd/kubeadm/app/discovery/token/token.go:96
k8s.io/kubernetes/cmd/kubeadm/app/discovery/token.RetrieveValidatedConfigInfo

suspect PRs

• [Kubeadm]: Add support for ECDSA-P384 encryption algorithm kubernetes#131677
• Deprecate kubeconfig's preference field in favor of kuberc kubernetes#131741

[neolit123]

confirmed it's the second pr 131741 that broke this

• Deprecate kubeconfig's preference field in favor of kuberc kubernetes#131741

adhoc test failed here:
https://github.com/neolit123/kubeadm-test/actions/runs/15157540968

[neolit123]

reproduced it with this locally

sudo kubeadm join 192.168.0.101:6443 --control-plane --token abcdef.abcdef0123456789 --discovery-token-ca-cert-hash sha256:3b793efefe27a19f93b0fbe6e637e9c41d0dde8a377d6ab1c0f656bf1136dd8a --certificate-key 2e3c4239bc78c27f40530ddc2df7049a2c5ff146e5a702e9c9b6cdbec70df9f3 --ignore-preflight-errors=all --dry-run --v=6

[neolit123]

tested this fix locally and it works

diff --git a/cmd/kubeadm/app/util/apiclient/dryrun.go b/cmd/kubeadm/app/util/apiclient/dryrun.go
index c677e4c502e..0d879a44106 100644
--- a/cmd/kubeadm/app/util/apiclient/dryrun.go
+++ b/cmd/kubeadm/app/util/apiclient/dryrun.go
@@ -610,7 +610,7 @@ kind: Config
 users: null
 `)
        data := map[string]string{
-               bootstrapapi.JWSSignatureKeyPrefix + "abcdef": "eyJhbGciOiJIUzI1NiIsImtpZCI6ImFiY2RlZiJ9..wUZ0q9o0VK1RWFptmSBOEem2bXHWrHyxrposHg0mb1w",
+               bootstrapapi.JWSSignatureKeyPrefix + "abcdef": "eyJhbGciOiJIUzI1NiIsImtpZCI6ImFiY2RlZiJ9..rh3cVKiU2mdt3CqHzC81sNE-4WQLRHMtXduHWfSbrIM",
                bootstrapapi.KubeConfigKey:                    kubeconfig,
        }
        return getConfigMap(metav1.NamespacePublic, bootstrapapi.ConfigMapClusterInfo, data)

what happened is that they changed the cluster-info config map used for dry-run, so we must recalculate a new JWS signature from the changed config-map, or the function DetachedTokenIsValid from k8s.io/cluster-bootstrap/token/jws/jws.go will return false during the validation of cluster-info from kubeadm.

[neolit123]

fix pr

• kubeadm: fix dryrun-latest e2e by updating cluster-info fixture kubernetes#131880