Fix the bug that tunnel-agent/tunnel-server crashes when the local certificate can not be loaded correctly

[SataQiu]

What type of PR is this?

/kind bug

What this PR does / why we need it:

Fix the bug that tunnel-agent/tunnel-server crashes when the local certificate can not be loaded correctly

Which issue(s) this PR fixes:

Fixes #377

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Fix the bug that tunnel-agent/tunnel-server crashes when the local certificate can not be loaded correctly

other Note

[SataQiu]

With this patch, the tunnel-agent can recover from a damaged certificate automatically:

I0706 07:40:48.416970       1 start.go:48] yurttunnel-agent version: projectinfo.Info{GitVersion:"v0.4.0", GitCommit:"9426d63", BuildDate:"2021-07-06T07:26:53Z", GoVersion:"go1.13.15", Compiler:"gc", Platform:"linux/amd64"}
I0706 07:40:48.417017       1 options.go:136] ipv4=172.16.247.51&host=izbp1ikl8dfbhoc2661jufz is set for agent identifies
I0706 07:40:48.417021       1 options.go:141] neither --kube-config nor --apiserver-addr is set, will use /etc/kubernetes/kubelet.conf as the kubeconfig
I0706 07:40:48.417024       1 options.go:145] create the clientset based on the kubeconfig(/etc/kubernetes/kubelet.conf).
I0706 07:40:48.436797       1 start.go:84] yurttunnel-server address: 122.43.234.97:32502
I0706 07:40:48.436840       1 certificate_store.go:130] Loading cert/key pair from "/var/lib/yurttunnel-agent/pki/yurttunnel-agent-current.pem".
W0706 07:40:48.436904       1 filestore_wrapper.go:50] unexpected error occurred when loading the certificate: could not convert data from "/var/lib/yurttunnel-agent/pki/yurttunnel-agent-current.pem" into cert/key pair: tls: failed to find any PEM data in certificate input, will regenerate it
I0706 07:40:48.437075       1 anpagent.go:57] start serving grpc request redirected from yurttunnel-server: 122.43.234.97:32502
I0706 07:40:48.437194       1 util.go:45] "start handling meta requests(metrics/pprof)" server endpoint="127.0.0.1:10266"
E0706 07:41:08.437575       1 clientset.go:156] "cannot sync once" err="rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing dial tcp 122.43.234.97:32502: i/o timeout\""
E0706 07:41:33.650318       1 clientset.go:156] "cannot sync once" err="rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing dial tcp 122.43.234.97:32502: i/o timeout\""

[SataQiu]

We do not need to check the DNSNames and IPAddresses of the local certificate, because the cert-manager has already checked it for us: https://github.com/kubernetes/client-go/blob/ca3a47f0b44a052c089e90389cfaf8a4b9ef98ad/util/certificate/certificate_manager.go#L582-L584

	if !m.certSatisfiesTemplateLocked() {
		return m.now()
	}

[SataQiu]

/assign @rambohe-ch

[SataQiu]

@Fei-Guo PTAL!

[rambohe-ch]

/lgtm

[rambohe-ch]

We do not need to check the DNSNames and IPAddresses of the local certificate, because the cert-manager has already checked it for us: https://github.com/kubernetes/client-go/blob/ca3a47f0b44a052c089e90389cfaf8a4b9ef98ad/util/certificate/certificate_manager.go#L582-L584

	if !m.certSatisfiesTemplateLocked() {
		return m.now()
	}

It looks like that certificate will be updated automatically if dnsnames or ips changed. yes, so we do not need to check alternate name values again.

[rambohe-ch]

/approve

[openyurt-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rambohe-ch, SataQiu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rambohe-ch]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment