Merge pull request #11921 from johngmyers/rename-k8s-ca

Rename the "ca" keyset to "kubernetes-ca"

cmd/kops/create_keypair.go

@@ -80,8 +80,8 @@ type CreateKeypairOptions struct {
 
 var rotatableKeysets = sets.NewString(
 	"apiserver-aggregator-ca",
-	"ca",
 	"etcd-clients-ca-cilium",
+	"kubernetes-ca",
 	"service-account",
 )
 
@@ -177,7 +177,7 @@ func RunCreateKeypair(ctx context.Context, f *util.Factory, out io.Writer, optio
 		}
 
 		commonName := options.Keyset
-		if commonName == "ca" {
+		if commonName == "kubernetes-ca" {
 			commonName = "kubernetes"
 		}
 		req := pki.IssueCertRequest{

nodeup/pkg/model/kubelet_test.go

@@ -288,8 +288,8 @@ func BuildNodeupModelContext(model *testutils.Model) (*NodeupModelContext, error
 	}
 
 	// Are we mocking out too much of the apply_cluster logic?
-	nodeupModelContext.NodeupConfig.CAs["ca"] = dummyCertificate + nextCertificate
+	nodeupModelContext.NodeupConfig.CAs["kubernetes-ca"] = dummyCertificate + nextCertificate
-	nodeupModelContext.NodeupConfig.KeypairIDs["ca"] = "3"
+	nodeupModelContext.NodeupConfig.KeypairIDs["kubernetes-ca"] = "3"
 
 	if nodeupModelContext.NodeupConfig.APIServerConfig != nil {
 		saPublicKeys, _ := rotatingPrivateKeyset().ToPublicKeys()
@@ -379,7 +379,7 @@ func RunGoldenTest(t *testing.T, basedir string, key string, builder func(*Nodeu
 	keystore.T = t
 	saKeyset, _ := rotatingPrivateKeyset().ToAPIObject("service-account", true)
 	keystore.privateKeysets = map[string]*kops.Keyset{
-		"ca":                      simplePrivateKeyset(dummyCertificate, dummyKey),
+		"kubernetes-ca":           simplePrivateKeyset(dummyCertificate, dummyKey),
 		"apiserver-aggregator-ca": simplePrivateKeyset(dummyCertificate, dummyKey),
 		"kube-controller-manager": simplePrivateKeyset(dummyCertificate, dummyKey),
 		"kube-proxy":              simplePrivateKeyset(dummyCertificate, dummyKey),
@@ -387,7 +387,7 @@ func RunGoldenTest(t *testing.T, basedir string, key string, builder func(*Nodeu
 		"service-account":         saKeyset,
 	}
 	keystore.certs = map[string]*pki.Certificate{
-		"ca":                      mustParseCertificate(dummyCertificate),
+		"kubernetes-ca":           mustParseCertificate(dummyCertificate),
 		"apiserver-aggregator-ca": mustParseCertificate(dummyCertificate),
 		"kube-controller-manager": mustParseCertificate(dummyCertificate),
 		"kube-proxy":              mustParseCertificate(dummyCertificate),

nodeup/pkg/model/tests/golden/awsiam/tasks-kube-apiserver.yaml

@@ -200,7 +200,7 @@ contents:
     alternateNames:
     - localhost
     - 127.0.0.1
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: aws-iam-authenticator
     type: server
@@ -216,7 +216,7 @@ contents:
     alternateNames:
     - localhost
     - 127.0.0.1
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: aws-iam-authenticator
     type: server
@@ -300,7 +300,7 @@ type: file
 contents:
   task:
     Name: kubelet-api
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubelet-api
     type: client
@@ -311,7 +311,7 @@ type: file
 contents:
   task:
     Name: kubelet-api
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubelet-api
     type: client
@@ -335,7 +335,7 @@ Name: aws-iam-authenticator
 alternateNames:
 - localhost
 - 127.0.0.1
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: aws-iam-authenticator
 type: server
@@ -347,7 +347,7 @@ subject:
 type: client
 ---
 Name: kubelet-api
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: kubelet-api
 type: client

nodeup/pkg/model/tests/golden/dedicated-apiserver/tasks-kube-apiserver.yaml

@@ -240,7 +240,7 @@ type: file
 contents:
   task:
     Name: kubelet-api
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubelet-api
     type: client
@@ -251,7 +251,7 @@ type: file
 contents:
   task:
     Name: kubelet-api
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubelet-api
     type: client
@@ -278,7 +278,7 @@ subject:
 type: client
 ---
 Name: kubelet-api
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: kubelet-api
 type: client

nodeup/pkg/model/tests/golden/minimal/tasks-kops-controller.yaml

@@ -2,6 +2,34 @@ mode: "0755"
 path: /etc/kubernetes/kops-controller
 type: directory
 ---
+contents:
+  task:
+    Name: kops-controller
+    alternateNames:
+    - kops-controller.internal.minimal.example.com
+    signer: kubernetes-ca
+    subject:
+      CommonName: kops-controller
+    type: server
+mode: "0644"
+owner: kops-controller
+path: /etc/kubernetes/kops-controller/kops-controller.crt
+type: file
+---
+contents:
+  task:
+    Name: kops-controller
+    alternateNames:
+    - kops-controller.internal.minimal.example.com
+    signer: kubernetes-ca
+    subject:
+      CommonName: kops-controller
+    type: server
+mode: "0600"
+owner: kops-controller
+path: /etc/kubernetes/kops-controller/kops-controller.key
+type: file
+---
 contents: |
   -----BEGIN CERTIFICATE-----
   MIIC2DCCAcCgAwIBAgIRALJXAkVj964tq67wMSI8oJQwDQYJKoZIhvcNAQELBQAw
@@ -23,7 +51,7 @@ contents: |
   -----END CERTIFICATE-----
 mode: "0600"
 owner: kops-controller
-path: /etc/kubernetes/kops-controller/ca.crt
+path: /etc/kubernetes/kops-controller/kubernetes-ca.crt
 type: file
 ---
 contents: |
@@ -56,41 +84,13 @@ contents: |
   -----END RSA PRIVATE KEY-----
 mode: "0600"
 owner: kops-controller
-path: /etc/kubernetes/kops-controller/ca.key
+path: /etc/kubernetes/kops-controller/kubernetes-ca.key
-type: file
----
-contents:
-  task:
-    Name: kops-controller
-    alternateNames:
-    - kops-controller.internal.minimal.example.com
-    signer: ca
-    subject:
-      CommonName: kops-controller
-    type: server
-mode: "0644"
-owner: kops-controller
-path: /etc/kubernetes/kops-controller/kops-controller.crt
-type: file
----
-contents:
-  task:
-    Name: kops-controller
-    alternateNames:
-    - kops-controller.internal.minimal.example.com
-    signer: ca
-    subject:
-      CommonName: kops-controller
-    type: server
-mode: "0600"
-owner: kops-controller
-path: /etc/kubernetes/kops-controller/kops-controller.key
 type: file
 ---
 Name: kops-controller
 alternateNames:
 - kops-controller.internal.minimal.example.com
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: kops-controller
 type: server

nodeup/pkg/model/tests/golden/minimal/tasks-kube-apiserver.yaml

@@ -240,7 +240,7 @@ type: file
 contents:
   task:
     Name: kubelet-api
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubelet-api
     type: client
@@ -251,7 +251,7 @@ type: file
 contents:
   task:
     Name: kubelet-api
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubelet-api
     type: client
@@ -278,7 +278,7 @@ subject:
 type: client
 ---
 Name: kubelet-api
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: kubelet-api
 type: client

nodeup/pkg/model/tests/golden/minimal/tasks-kube-controller-manager.yaml

@@ -219,21 +219,21 @@ contents:
     CA:
       task:
         Name: kube-controller-manager
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-controller-manager
         type: client
     Cert:
       task:
         Name: kube-controller-manager
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-controller-manager
         type: client
     Key:
       task:
         Name: kube-controller-manager
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-controller-manager
         type: client
@@ -250,7 +250,7 @@ path: /var/log/kube-controller-manager.log
 type: file
 ---
 Name: kube-controller-manager
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: system:kube-controller-manager
 type: client
@@ -258,21 +258,21 @@ type: client
 CA:
   task:
     Name: kube-controller-manager
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-controller-manager
     type: client
 Cert:
   task:
     Name: kube-controller-manager
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-controller-manager
     type: client
 Key:
   task:
     Name: kube-controller-manager
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-controller-manager
     type: client

nodeup/pkg/model/tests/golden/minimal/tasks-kube-proxy.yaml

@@ -79,21 +79,21 @@ contents:
     CA:
       task:
         Name: kube-proxy
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-proxy
         type: client
     Cert:
       task:
         Name: kube-proxy
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-proxy
         type: client
     Key:
       task:
         Name: kube-proxy
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-proxy
         type: client
@@ -110,7 +110,7 @@ path: /var/log/kube-proxy.log
 type: file
 ---
 Name: kube-proxy
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: system:kube-proxy
 type: client
@@ -118,21 +118,21 @@ type: client
 CA:
   task:
     Name: kube-proxy
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-proxy
     type: client
 Cert:
   task:
     Name: kube-proxy
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-proxy
     type: client
 Key:
   task:
     Name: kube-proxy
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-proxy
     type: client

nodeup/pkg/model/tests/golden/minimal/tasks-kube-scheduler.yaml

@@ -68,21 +68,21 @@ contents:
     CA:
       task:
         Name: kube-scheduler
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-scheduler
         type: client
     Cert:
       task:
         Name: kube-scheduler
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-scheduler
         type: client
     Key:
       task:
         Name: kube-scheduler
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-scheduler
         type: client
@@ -99,7 +99,7 @@ path: /var/log/kube-scheduler.log
 type: file
 ---
 Name: kube-scheduler
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: system:kube-scheduler
 type: client
@@ -107,21 +107,21 @@ type: client
 CA:
   task:
     Name: kube-scheduler
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-scheduler
     type: client
 Cert:
   task:
     Name: kube-scheduler
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-scheduler
     type: client
 Key:
   task:
     Name: kube-scheduler
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-scheduler
     type: client

nodeup/pkg/model/tests/golden/minimal/tasks-kubectl.yaml

@@ -11,7 +11,7 @@ contents:
     CA:
       task:
         Name: kubecfg
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: kubecfg
           Organization:
@@ -20,7 +20,7 @@ contents:
     Cert:
       task:
         Name: kubecfg
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: kubecfg
           Organization:
@@ -29,7 +29,7 @@ contents:
     Key:
       task:
         Name: kubecfg
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: kubecfg
           Organization:
@@ -42,7 +42,7 @@ path: /var/lib/kubectl/kubeconfig
 type: file
 ---
 Name: kubecfg
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: kubecfg
   Organization:
@@ -52,7 +52,7 @@ type: client
 CA:
   task:
     Name: kubecfg
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubecfg
       Organization:
@@ -61,7 +61,7 @@ CA:
 Cert:
   task:
     Name: kubecfg
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubecfg
       Organization:
@@ -70,7 +70,7 @@ Cert:
 Key:
   task:
     Name: kubecfg
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubecfg
       Organization:

nodeup/pkg/model/tests/golden/minimal/tasks-secret.yaml

@@ -48,7 +48,7 @@ contents:
     - 100.64.0.1
     - 127.0.0.1
     includeRootCertificate: true
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubernetes-master
     type: server
@@ -69,7 +69,7 @@ contents:
     - 100.64.0.1
     - 127.0.0.1
     includeRootCertificate: true
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubernetes-master
     type: server
@@ -102,7 +102,7 @@ alternateNames:
 - 100.64.0.1
 - 127.0.0.1
 includeRootCertificate: true
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: kubernetes-master
 type: server

nodeup/pkg/model/tests/golden/side-loading/tasks-kube-apiserver-amd64.yaml

@@ -240,7 +240,7 @@ type: file
 contents:
   task:
     Name: kubelet-api
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubelet-api
     type: client
@@ -251,7 +251,7 @@ type: file
 contents:
   task:
     Name: kubelet-api
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubelet-api
     type: client
@@ -278,7 +278,7 @@ subject:
 type: client
 ---
 Name: kubelet-api
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: kubelet-api
 type: client

nodeup/pkg/model/tests/golden/side-loading/tasks-kube-apiserver-arm64.yaml

@@ -240,7 +240,7 @@ type: file
 contents:
   task:
     Name: kubelet-api
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubelet-api
     type: client
@@ -251,7 +251,7 @@ type: file
 contents:
   task:
     Name: kubelet-api
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubelet-api
     type: client
@@ -278,7 +278,7 @@ subject:
 type: client
 ---
 Name: kubelet-api
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: kubelet-api
 type: client

nodeup/pkg/model/tests/golden/side-loading/tasks-kube-controller-manager-amd64.yaml

@@ -219,21 +219,21 @@ contents:
     CA:
       task:
         Name: kube-controller-manager
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-controller-manager
         type: client
     Cert:
       task:
         Name: kube-controller-manager
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-controller-manager
         type: client
     Key:
       task:
         Name: kube-controller-manager
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-controller-manager
         type: client
@@ -250,7 +250,7 @@ path: /var/log/kube-controller-manager.log
 type: file
 ---
 Name: kube-controller-manager
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: system:kube-controller-manager
 type: client
@@ -258,21 +258,21 @@ type: client
 CA:
   task:
     Name: kube-controller-manager
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-controller-manager
     type: client
 Cert:
   task:
     Name: kube-controller-manager
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-controller-manager
     type: client
 Key:
   task:
     Name: kube-controller-manager
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-controller-manager
     type: client

nodeup/pkg/model/tests/golden/side-loading/tasks-kube-controller-manager-arm64.yaml

@@ -219,21 +219,21 @@ contents:
     CA:
       task:
         Name: kube-controller-manager
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-controller-manager
         type: client
     Cert:
       task:
         Name: kube-controller-manager
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-controller-manager
         type: client
     Key:
       task:
         Name: kube-controller-manager
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-controller-manager
         type: client
@@ -250,7 +250,7 @@ path: /var/log/kube-controller-manager.log
 type: file
 ---
 Name: kube-controller-manager
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: system:kube-controller-manager
 type: client
@@ -258,21 +258,21 @@ type: client
 CA:
   task:
     Name: kube-controller-manager
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-controller-manager
     type: client
 Cert:
   task:
     Name: kube-controller-manager
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-controller-manager
     type: client
 Key:
   task:
     Name: kube-controller-manager
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-controller-manager
     type: client

nodeup/pkg/model/tests/golden/side-loading/tasks-kube-proxy-amd64.yaml

@@ -79,21 +79,21 @@ contents:
     CA:
       task:
         Name: kube-proxy
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-proxy
         type: client
     Cert:
       task:
         Name: kube-proxy
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-proxy
         type: client
     Key:
       task:
         Name: kube-proxy
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-proxy
         type: client
@@ -110,7 +110,7 @@ path: /var/log/kube-proxy.log
 type: file
 ---
 Name: kube-proxy
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: system:kube-proxy
 type: client
@@ -118,21 +118,21 @@ type: client
 CA:
   task:
     Name: kube-proxy
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-proxy
     type: client
 Cert:
   task:
     Name: kube-proxy
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-proxy
     type: client
 Key:
   task:
     Name: kube-proxy
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-proxy
     type: client

nodeup/pkg/model/tests/golden/side-loading/tasks-kube-proxy-arm64.yaml

@@ -79,21 +79,21 @@ contents:
     CA:
       task:
         Name: kube-proxy
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-proxy
         type: client
     Cert:
       task:
         Name: kube-proxy
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-proxy
         type: client
     Key:
       task:
         Name: kube-proxy
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-proxy
         type: client
@@ -110,7 +110,7 @@ path: /var/log/kube-proxy.log
 type: file
 ---
 Name: kube-proxy
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: system:kube-proxy
 type: client
@@ -118,21 +118,21 @@ type: client
 CA:
   task:
     Name: kube-proxy
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-proxy
     type: client
 Cert:
   task:
     Name: kube-proxy
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-proxy
     type: client
 Key:
   task:
     Name: kube-proxy
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-proxy
     type: client

nodeup/pkg/model/tests/golden/side-loading/tasks-kube-scheduler-amd64.yaml

@@ -68,21 +68,21 @@ contents:
     CA:
       task:
         Name: kube-scheduler
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-scheduler
         type: client
     Cert:
       task:
         Name: kube-scheduler
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-scheduler
         type: client
     Key:
       task:
         Name: kube-scheduler
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-scheduler
         type: client
@@ -99,7 +99,7 @@ path: /var/log/kube-scheduler.log
 type: file
 ---
 Name: kube-scheduler
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: system:kube-scheduler
 type: client
@@ -107,21 +107,21 @@ type: client
 CA:
   task:
     Name: kube-scheduler
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-scheduler
     type: client
 Cert:
   task:
     Name: kube-scheduler
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-scheduler
     type: client
 Key:
   task:
     Name: kube-scheduler
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-scheduler
     type: client

nodeup/pkg/model/tests/golden/side-loading/tasks-kube-scheduler-arm64.yaml

@@ -68,21 +68,21 @@ contents:
     CA:
       task:
         Name: kube-scheduler
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-scheduler
         type: client
     Cert:
       task:
         Name: kube-scheduler
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-scheduler
         type: client
     Key:
       task:
         Name: kube-scheduler
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: system:kube-scheduler
         type: client
@@ -99,7 +99,7 @@ path: /var/log/kube-scheduler.log
 type: file
 ---
 Name: kube-scheduler
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: system:kube-scheduler
 type: client
@@ -107,21 +107,21 @@ type: client
 CA:
   task:
     Name: kube-scheduler
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-scheduler
     type: client
 Cert:
   task:
     Name: kube-scheduler
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-scheduler
     type: client
 Key:
   task:
     Name: kube-scheduler
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: system:kube-scheduler
     type: client

nodeup/pkg/model/tests/golden/without-etcd-events/tasks-kube-apiserver.yaml

@@ -239,7 +239,7 @@ type: file
 contents:
   task:
     Name: kubelet-api
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubelet-api
     type: client
@@ -250,7 +250,7 @@ type: file
 contents:
   task:
     Name: kubelet-api
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kubelet-api
     type: client
@@ -277,7 +277,7 @@ subject:
 type: client
 ---
 Name: kubelet-api
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: kubelet-api
 type: client

nodeup/pkg/model/tests/protokube/tasks-protokube.yaml

@@ -24,7 +24,7 @@ contents:
     CA:
       task:
         Name: kops
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: kops
           Organization:
@@ -33,7 +33,7 @@ contents:
     Cert:
       task:
         Name: kops
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: kops
           Organization:
@@ -42,7 +42,7 @@ contents:
     Key:
       task:
         Name: kops
-        signer: ca
+        signer: kubernetes-ca
         subject:
           CommonName: kops
           Organization:
@@ -55,7 +55,7 @@ path: /var/lib/kops/kubeconfig
 type: file
 ---
 Name: kops
-signer: ca
+signer: kubernetes-ca
 subject:
   CommonName: kops
   Organization:
@@ -65,7 +65,7 @@ type: client
 CA:
   task:
     Name: kops
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kops
       Organization:
@@ -74,7 +74,7 @@ CA:
 Cert:
   task:
     Name: kops
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kops
       Organization:
@@ -83,7 +83,7 @@ Cert:
 Key:
   task:
     Name: kops
-    signer: ca
+    signer: kubernetes-ca
     subject:
       CommonName: kops
       Organization:

pkg/model/bootstrapscript.go

@@ -212,7 +212,7 @@ func (b *BootstrapScript) buildEnvironmentVariables(cluster *kops.Cluster) (map[
 // ResourceNodeUp generates and returns a nodeup (bootstrap) script from a
 // template file, substituting in specific env vars & cluster spec configuration
 func (b *BootstrapScriptBuilder) ResourceNodeUp(c *fi.ModelBuilderContext, ig *kops.InstanceGroup) (fi.Resource, error) {
-	keypairs := []string{"ca"}
+	keypairs := []string{"kubernetes-ca"}
 	if model.UseCiliumEtcd(b.Cluster) {
 		keypairs = append(keypairs, "etcd-clients-ca-cilium")
 		if !model.UseKopsControllerForNodeBootstrap(b.Cluster) {

pkg/model/openstackmodel/tests/servergroup/adds-additional-security-groups.yaml

@@ -79,7 +79,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

pkg/model/openstackmodel/tests/servergroup/adds-cloud-labels-from-ClusterSpec.yaml

@@ -78,7 +78,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

pkg/model/openstackmodel/tests/servergroup/adds-cloud-labels-from-InstanceGroupSpec.yaml

@@ -78,7 +78,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

pkg/model/openstackmodel/tests/servergroup/configures-server-group-affinity-with-annotations.yaml

@@ -77,7 +77,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

pkg/model/openstackmodel/tests/servergroup/multizone-setup-3-masters-3-nodes-without-bastion-auto-zone-distribution.yaml

@@ -520,7 +520,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

pkg/model/openstackmodel/tests/servergroup/multizone-setup-3-masters-3-nodes-without-bastion-with-API-loadbalancer.yaml

@@ -495,7 +495,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

pkg/model/openstackmodel/tests/servergroup/multizone-setup-3-masters-3-nodes-without-bastion.yaml

@@ -532,7 +532,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

pkg/model/openstackmodel/tests/servergroup/multizone-setup-3-masters-3-nodes-without-external-router.yaml

@@ -454,7 +454,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

pkg/model/openstackmodel/tests/servergroup/one-master-one-node-one-bastion-2.yaml

@@ -225,7 +225,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

pkg/model/openstackmodel/tests/servergroup/one-master-one-node-one-bastion.yaml

@@ -251,7 +251,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

pkg/model/openstackmodel/tests/servergroup/one-master-one-node-without-bastion-no-public-ip-association.yaml

@@ -156,7 +156,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

pkg/model/openstackmodel/tests/servergroup/one-master-one-node.yaml

@@ -182,7 +182,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

pkg/model/openstackmodel/tests/servergroup/uses-instance-group-subnet-as-availability-zones-fallback.yaml

@@ -79,7 +79,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

pkg/model/openstackmodel/tests/servergroup/uses-instance-group-zones-as-availability-zones.yaml

@@ -79,7 +79,7 @@ subject: cn=apiserver-aggregator-ca
 type: ca
 ---
 Lifecycle: ""
-Name: ca
+Name: kubernetes-ca
 Signer: null
 alternateNames: null
 oldFormat: false

tests/integration/update_cluster/apiservernodes/cloudformation.json.extracted.yaml

@@ -163,7 +163,7 @@ Resources.AWSEC2LaunchTemplateapiserverapiserversminimalexamplecom.Properties.La
   ConfigBase: memfs://clusters.example.com/minimal.example.com
   InstanceGroupName: apiserver
   InstanceGroupRole: APIServer
-  NodeupConfigHash: eh3RWuFJe5kMXyyFYvjQhH+LRHuyNmI7A9PU8QcOWyE=
+  NodeupConfigHash: bizbXRlTzS5f2hF03722S9wRGUWdd4mw322EOGl6+HM=
 
   __EOF_KUBE_ENV
 
@@ -416,7 +416,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersminimalexamplecom.Properties.
   ConfigBase: memfs://clusters.example.com/minimal.example.com
   InstanceGroupName: master-us-test-1a
   InstanceGroupRole: Master
-  NodeupConfigHash: QQcZly7rSirhmZKom8mMCSVuksgGq1r3tASmbmrE0cI=
+  NodeupConfigHash: IEvtyzjpnDY+p8fpnpIYTbw+xEoVgrcz8y473fUCM10=
 
   __EOF_KUBE_ENV
 
@@ -587,7 +587,7 @@ Resources.AWSEC2LaunchTemplatenodesminimalexamplecom.Properties.LaunchTemplateDa
   ConfigBase: memfs://clusters.example.com/minimal.example.com
   InstanceGroupName: nodes
   InstanceGroupRole: Node
-  NodeupConfigHash: Exh/JxdKlfAU6pw0iJJklgc7kZM7tKyVYIBYXUaPaz4=
+  NodeupConfigHash: Iaffzj3I5NOIlGIOxaImUn0St+IMyJDYd9fwt4SurfI=
 
   __EOF_KUBE_ENV
 

tests/integration/update_cluster/aws-lb-controller/data/aws_launch_template_master-us-test-1a.masters.minimal.example.com_user_data

@@ -244,7 +244,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/minimal.example.com
 InstanceGroupName: master-us-test-1a
 InstanceGroupRole: Master
-NodeupConfigHash: y5Iu0E2gtxBXC/ET5zvx3DK9ABwiQMrISzXbwmql66I=
+NodeupConfigHash: HUpDz4hcCqIrgjEQ2nPEcFsyD/P7Y+hdZ6H87cwYMeY=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/aws-lb-controller/data/aws_launch_template_nodes.minimal.example.com_user_data

@@ -162,7 +162,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/minimal.example.com
 InstanceGroupName: nodes
 InstanceGroupRole: Node
-NodeupConfigHash: Exh/JxdKlfAU6pw0iJJklgc7kZM7tKyVYIBYXUaPaz4=
+NodeupConfigHash: Iaffzj3I5NOIlGIOxaImUn0St+IMyJDYd9fwt4SurfI=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/aws-lb-controller/data/aws_s3_bucket_object_minimal.example.com-addons-bootstrap_content

@@ -6,7 +6,7 @@ spec:
   addons:
   - id: k8s-1.16
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 924fbd798d4396bb3c7cfb1d4a76ef4342b32caf
+    manifestHash: e166ef53ab5115b9bee0ce3cb4df1192032cb48d
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:

tests/integration/update_cluster/aws-lb-controller/data/aws_s3_bucket_object_minimal.example.com-addons-kops-controller.addons.k8s.io-k8s-1.16_content

@@ -1,7 +1,7 @@
 apiVersion: v1
 data:
   config.yaml: |
-    {"cloud":"aws","configBase":"memfs://clusters.example.com/minimal.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.minimal.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
+    {"cloud":"aws","configBase":"memfs://clusters.example.com/minimal.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.minimal.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["kubernetes-ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
 kind: ConfigMap
 metadata:
   creationTimestamp: null

tests/integration/update_cluster/aws-lb-controller/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1a_content

@@ -90,27 +90,6 @@ CAs:
     QdlXZOfmBT6cqxIX/RMHXhpHwRiqPsTO8IO2bVA8CSzxNwMuSv/ZtrMHoh8+PcVW
     HLtkTXH8
     -----END CERTIFICATE-----
-  ca: |
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
-    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
-    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
-    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
-    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
-    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
-    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
-    -----END CERTIFICATE-----
   etcd-clients-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBcjCCARygAwIBAgIMFo1ogHnr26DL9YkqMA0GCSqGSIb3DQEBCwUAMBoxGDAW
@@ -132,12 +111,33 @@ CAs:
     x+PeBDANBgkqhkiG9w0BAQsFAANBAF1xUz77PlUVUnd9duF8F7plou0TONC9R6/E
     YQ8C6vM1b+9NSDGjCW8YmwEU2fBgskb/BBX2lwVZ32/RUEju4Co=
     -----END CERTIFICATE-----
+  kubernetes-ca: |
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
+    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
+    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
+    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
+    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
+    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
+    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
+    -----END CERTIFICATE-----
 ClusterName: minimal.example.com
 Hooks:
 - null
 - null
 KeypairIDs:
-  ca: "6976381481633145814258938760"
+  kubernetes-ca: "6976381481633145814258938760"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/aws-lb-controller/data/aws_s3_bucket_object_nodeupconfig-nodes_content

@@ -10,7 +10,7 @@ Assets:
   - ae13d7b5c05bd180ea9b5b68f44bdaa7bfb41034a2ef1d68fd8e1259797d642f@https://storage.googleapis.com/k8s-artifacts-cni/release/v0.8.7/cni-plugins-linux-arm64-v0.8.7.tgz
   - be8c9a5a06ebec8fb1d36e867cd00fb5777746a9812a0cae2966778ff899c525@https://download.docker.com/linux/static/stable/aarch64/docker-20.10.7.tgz
 CAs:
-  ca: |
+  kubernetes-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
     BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw

tests/integration/update_cluster/bastionadditional_user-data/data/aws_launch_template_master-us-test-1a.masters.bastionuserdata.example.com_user_data

@@ -244,7 +244,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/bastionuserdata.example.com
 InstanceGroupName: master-us-test-1a
 InstanceGroupRole: Master
-NodeupConfigHash: EC6eLakv0ZlVZR9ziNrzr76BgkCrI2c4OM2zX8LIkG8=
+NodeupConfigHash: LyzJsUmLeSGDe4a7XwVpeEkV76bnhR+JhWFNI4lcflQ=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/bastionadditional_user-data/data/aws_launch_template_nodes.bastionuserdata.example.com_user_data

@@ -171,7 +171,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/bastionuserdata.example.com
 InstanceGroupName: nodes
 InstanceGroupRole: Node
-NodeupConfigHash: MpWZX+PUsGwA0nfuKiIPHb7R1+DGI3aHJQQnqL6a5aA=
+NodeupConfigHash: 26M14rQZ8L8CV0Y96hmmOTXUtieb3T8h2Ta3SorJmM0=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/bastionadditional_user-data/data/aws_s3_bucket_object_bastionuserdata.example.com-addons-bootstrap_content

@@ -6,7 +6,7 @@ spec:
   addons:
   - id: k8s-1.16
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 8c2001bb23990c4cf33b9bb263db6c3f0476b5ed
+    manifestHash: c2683067162111cd530003bbbd5e2c2949a706a4
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:

tests/integration/update_cluster/bastionadditional_user-data/data/aws_s3_bucket_object_bastionuserdata.example.com-addons-kops-controller.addons.k8s.io-k8s-1.16_content

@@ -1,7 +1,7 @@
 apiVersion: v1
 data:
   config.yaml: |
-    {"cloud":"aws","configBase":"memfs://clusters.example.com/bastionuserdata.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.bastionuserdata.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
+    {"cloud":"aws","configBase":"memfs://clusters.example.com/bastionuserdata.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.bastionuserdata.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["kubernetes-ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
 kind: ConfigMap
 metadata:
   creationTimestamp: null

tests/integration/update_cluster/bastionadditional_user-data/data/aws_s3_bucket_object_nodeupconfig-bastion_content

@@ -10,7 +10,7 @@ Assets:
   - ae13d7b5c05bd180ea9b5b68f44bdaa7bfb41034a2ef1d68fd8e1259797d642f@https://storage.googleapis.com/k8s-artifacts-cni/release/v0.8.7/cni-plugins-linux-arm64-v0.8.7.tgz
   - be8c9a5a06ebec8fb1d36e867cd00fb5777746a9812a0cae2966778ff899c525@https://download.docker.com/linux/static/stable/aarch64/docker-20.10.7.tgz
 CAs:
-  ca: |
+  kubernetes-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
     BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw

tests/integration/update_cluster/bastionadditional_user-data/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1a_content

@@ -90,27 +90,6 @@ CAs:
     QdlXZOfmBT6cqxIX/RMHXhpHwRiqPsTO8IO2bVA8CSzxNwMuSv/ZtrMHoh8+PcVW
     HLtkTXH8
     -----END CERTIFICATE-----
-  ca: |
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
-    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
-    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
-    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
-    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
-    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
-    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
-    -----END CERTIFICATE-----
   etcd-clients-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBcjCCARygAwIBAgIMFo1ogHnr26DL9YkqMA0GCSqGSIb3DQEBCwUAMBoxGDAW
@@ -132,12 +111,33 @@ CAs:
     x+PeBDANBgkqhkiG9w0BAQsFAANBAF1xUz77PlUVUnd9duF8F7plou0TONC9R6/E
     YQ8C6vM1b+9NSDGjCW8YmwEU2fBgskb/BBX2lwVZ32/RUEju4Co=
     -----END CERTIFICATE-----
+  kubernetes-ca: |
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
+    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
+    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
+    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
+    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
+    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
+    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
+    -----END CERTIFICATE-----
 ClusterName: bastionuserdata.example.com
 Hooks:
 - null
 - null
 KeypairIDs:
-  ca: "6976381481633145814258938760"
+  kubernetes-ca: "6976381481633145814258938760"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/bastionadditional_user-data/data/aws_s3_bucket_object_nodeupconfig-nodes_content

@@ -10,7 +10,7 @@ Assets:
   - ae13d7b5c05bd180ea9b5b68f44bdaa7bfb41034a2ef1d68fd8e1259797d642f@https://storage.googleapis.com/k8s-artifacts-cni/release/v0.8.7/cni-plugins-linux-arm64-v0.8.7.tgz
   - be8c9a5a06ebec8fb1d36e867cd00fb5777746a9812a0cae2966778ff899c525@https://download.docker.com/linux/static/stable/aarch64/docker-20.10.7.tgz
 CAs:
-  ca: |
+  kubernetes-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
     BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw

tests/integration/update_cluster/complex/cloudformation.json.extracted.yaml

@@ -260,7 +260,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amasterscomplexexamplecom.Properties.
   ConfigBase: memfs://clusters.example.com/complex.example.com
   InstanceGroupName: master-us-test-1a
   InstanceGroupRole: Master
-  NodeupConfigHash: PQRM9+aReAE6cBbQ5/jZPTIWOi4twFm6WX3006HQo7E=
+  NodeupConfigHash: T+3ijeukhBYIMLfmvk+9L5+gHp6NG3OwxG9WXd5pPRc=
 
   __EOF_KUBE_ENV
 
@@ -451,7 +451,7 @@ Resources.AWSEC2LaunchTemplatenodescomplexexamplecom.Properties.LaunchTemplateDa
   ConfigBase: memfs://clusters.example.com/complex.example.com
   InstanceGroupName: nodes
   InstanceGroupRole: Node
-  NodeupConfigHash: mbOLBgLBgoGqpx2zyVDIFUBUUfzsIcn8qyYxUEnyROA=
+  NodeupConfigHash: W7b7uuGsni0zyJHnI2HWOYmL4lqQD0f7HyY/ZspETyU=
 
   __EOF_KUBE_ENV
 

tests/integration/update_cluster/complex/data/aws_launch_template_master-us-test-1a.masters.complex.example.com_user_data

@@ -259,7 +259,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/complex.example.com
 InstanceGroupName: master-us-test-1a
 InstanceGroupRole: Master
-NodeupConfigHash: PQRM9+aReAE6cBbQ5/jZPTIWOi4twFm6WX3006HQo7E=
+NodeupConfigHash: T+3ijeukhBYIMLfmvk+9L5+gHp6NG3OwxG9WXd5pPRc=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/complex/data/aws_launch_template_nodes.complex.example.com_user_data

@@ -171,7 +171,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/complex.example.com
 InstanceGroupName: nodes
 InstanceGroupRole: Node
-NodeupConfigHash: mbOLBgLBgoGqpx2zyVDIFUBUUfzsIcn8qyYxUEnyROA=
+NodeupConfigHash: W7b7uuGsni0zyJHnI2HWOYmL4lqQD0f7HyY/ZspETyU=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/complex/data/aws_s3_bucket_object_complex.example.com-addons-bootstrap_content

@@ -6,7 +6,7 @@ spec:
   addons:
   - id: k8s-1.16
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: e484c22607616fa14c65fd2ed24dba1874f35823
+    manifestHash: dc2da09db8bdf21ed98de1da23aff22fe12ba298
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:

tests/integration/update_cluster/complex/data/aws_s3_bucket_object_complex.example.com-addons-kops-controller.addons.k8s.io-k8s-1.16_content

@@ -1,7 +1,7 @@
 apiVersion: v1
 data:
   config.yaml: |
-    {"cloud":"aws","configBase":"memfs://clusters.example.com/complex.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.complex.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
+    {"cloud":"aws","configBase":"memfs://clusters.example.com/complex.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.complex.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["kubernetes-ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
 kind: ConfigMap
 metadata:
   creationTimestamp: null

tests/integration/update_cluster/complex/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1a_content

@@ -96,27 +96,6 @@ CAs:
     QdlXZOfmBT6cqxIX/RMHXhpHwRiqPsTO8IO2bVA8CSzxNwMuSv/ZtrMHoh8+PcVW
     HLtkTXH8
     -----END CERTIFICATE-----
-  ca: |
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
-    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
-    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
-    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
-    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
-    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
-    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
-    -----END CERTIFICATE-----
   etcd-clients-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBcjCCARygAwIBAgIMFo1ogHnr26DL9YkqMA0GCSqGSIb3DQEBCwUAMBoxGDAW
@@ -138,12 +117,33 @@ CAs:
     x+PeBDANBgkqhkiG9w0BAQsFAANBAF1xUz77PlUVUnd9duF8F7plou0TONC9R6/E
     YQ8C6vM1b+9NSDGjCW8YmwEU2fBgskb/BBX2lwVZ32/RUEju4Co=
     -----END CERTIFICATE-----
+  kubernetes-ca: |
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
+    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
+    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
+    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
+    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
+    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
+    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
+    -----END CERTIFICATE-----
 ClusterName: complex.example.com
 Hooks:
 - null
 - null
 KeypairIDs:
-  ca: "6976381481633145814258938760"
+  kubernetes-ca: "6976381481633145814258938760"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/complex/data/aws_s3_bucket_object_nodeupconfig-nodes_content

@@ -10,7 +10,7 @@ Assets:
   - ae13d7b5c05bd180ea9b5b68f44bdaa7bfb41034a2ef1d68fd8e1259797d642f@https://storage.googleapis.com/k8s-artifacts-cni/release/v0.8.7/cni-plugins-linux-arm64-v0.8.7.tgz
   - be8c9a5a06ebec8fb1d36e867cd00fb5777746a9812a0cae2966778ff899c525@https://download.docker.com/linux/static/stable/aarch64/docker-20.10.7.tgz
 CAs:
-  ca: |
+  kubernetes-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
     BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw

tests/integration/update_cluster/compress/data/aws_launch_template_master-us-test-1a.masters.compress.example.com_user_data

@@ -133,7 +133,7 @@ ensure-install-dir
 
 echo "H4sIAAAAAAAA/+xWTXPbNhC961dgppPJJSbFxE1bTg5V5LRWY6WslI9eIWBFoQIBZgFQVn99ZwFSH47VTKfHdjxjW7uLxe7btw8S2gY5tWat6nLEGN+5N6+X0+XsBlUHSCbGwPCVBlmyNdcORow13PAalt4ir2GquXPgSuYxwEhY47kygItgvGqgZAeLPDolJda2voMOdMmUWdsRYx2gU9aUrMius5cjacU2leC2qp0Z57nW/TVgBO5br6zpa2cmaD0CL+RUB+cBHR2EDox3qYtD9hfZdVa8iG0o87hvG1YwqWZLwB4ErrXdVag6paEmKGIVjHFjzb6xwU2C3xwB4q2aBKnACIi3XzHKiAY8uMx1IpOw5kH7FJqumdpgfMkKsgW/saj+5NTg3Eoo2UTv+N5NqIwRYytl5ERKBOdKNs7iz4ixOMwKbackYEnDHA3Tm8hGOeqx0qFWpq/qHW/AtVzAnVqD2AsN0XynGuUX3NSA8TMVqARMhKAao6kixJwH4z9aHRq44yvQ0XOTWjtlx6n9vdWAsbElCGtkcs6D516Z+lDmJ1htrN1G50eulbzsfmclLMB5VILSRtsCnA0o4LdgPScQvJAJ5r7zjfetK/O8eP5dhK8or8fj4jzy1w4QlRxGmCc2ffPo0ecjxlTDayjZ9nuX1QIzZXOa+hVvlUtE6orseREnRQ4NvkJYAyIMw3y/b4fbZsYDGq5nVfx4a503vEnzeXN/4juuEdWA8DmA8xvgEjDSBWSccsrK6xqh5t7iw9g39x75bfyXqlL3w5HfrxbQWA9XMeLq4bmf0YY2nXt4ILoexn9wVHoDjx8hLy08iIBQWfQlu75+ES2nFJw5F4jhwyh4qzLVA5YJ27QEZgb3vGk1kOGLDL98erv8sJj9gxS5bcEomXdF/sdu644Ze8GZVXFjSlaMx9nLa6JGHmXGpU14zcUWjCwjw5LETK3xaLUGnEdFPUiN4B6I1tPZzcIdxcZ7LjY3QL8XtDxCaVjujagAlZUlK5qxuyQDIlVJGVOJP7xMJRZHJxGFBPtR/EQU2oAwpfQLGzyJ/qB4F7gvDh1eNX2LxyXQiXga4t4mJT6xHfo+Z3hwcK5HUwQJxiuuB6jo6grt/b78auNtWCR2Rh/1uek3bdj+kj39ke/c08tNtvGqk75O6qWApdiADDqN90IOd4j5d/j0wlJefptETWvZv+/M7Z2HRh7sC2t9yfKvsOjm3fKE58X4xGPjqzp8zIjL+vAK3cAq1LUy9S03UtP6Dz1Al9T7lqMsWQONxX3GO640nXtVjMdz9cxYCWt3Zn4yGBX9dT8hwKtvnzyLKH8ROljPYv9+5IRnYn7FCcW845hrtcp7oPNjwBdMNeB3Frfpxe13yyhyWDPn7nMA5GnHz0WD4GytnHOj1uB8fzF4kR+/ReRN73WjhhPSb/8f/H9t8PSy1vQlDHuFoX6Hef8FAAD//wEAAP//MYvDU9kLAAA=" | base64 -d | gzip -d > conf/cluster_spec.yaml
 
-echo "H4sIAAAAAAAA/1TOzWqEMBQF4H2eIi/gaJkuSqCbhnZ+IFLE/ri8xGtrSbwhN9Hi0xc7K7eH7xyOdpT710jz2GNUEhYWmqZh/HoCRiU9+oFVWVqXOWHkA/6CDw4PlnxpyYeIvAvFZeIEk8VTpBxq8NsIbN0ic5GQU3EHe9SQQyXNPxI19ZjD7cIZ+FtJ83lc36rLR3xoK+ZOn5rjz/LyTmEd79uzvj5701XXbh7QPIo/AAAA//8BAAD//+70BFXPAAAA" | base64 -d | gzip -d > conf/kube_env.yaml
+echo "H4sIAAAAAAAA/1TOzU6EMBQF4H2foi/AoInBmSYuhER0AcG/jbtre8HGllt6W1Gf3uCs2J585+Q0jrIZIn1Zg1FJWFk0NI92qoFRSY9+ZFWW2mVOGPmA3+CDw4MmX2ryISLvQvEwc4JZYxsphx78NgJbt8hcJORUXMIePZFDJbt/JHoymMP5wj3wh5L299Xrl9ObeTcJlibY408/LRfrc4ufw1jVV7d3HVxXp8fqeCP+AAAA//8BAAD//++vzv/PAAAA" | base64 -d | gzip -d > conf/kube_env.yaml
 
 download-release
 echo "== nodeup node config done =="

tests/integration/update_cluster/compress/data/aws_launch_template_nodes.compress.example.com_user_data

@@ -133,7 +133,7 @@ ensure-install-dir
 
 echo "H4sIAAAAAAAA/3yS0W7bPAyF7/0UvCl601+2i/7BJvRiW7KhAZYuSJ6AsRhXiEymouQsbz/YTZplA3Zl+Bzah/zIJkh2U+Gtb20BgAf9+mU9Xc9n0fcUBwmAGDeBnIUtBqUCoEPGltZJIrY0DahKaiHFTEUjnNAzxVXm5Duy8K64i+mGHwdpv1NPwYLnrRQAPUX1whZq82AmhZNm99aC7vx+zpowhFPMLm9oGeXncbCbkDVRnM5nKwt1VZmPE1OZqqzrwdznFb1m0jR6XQHwIpoYO/rRU4zekYXbT3jQ2wLAd9iShd0HNW0TjZdySPpvP0b1tbmvTXXV+v3YSqA00mPhYydZP+f0csHVtFHy/kQU9KiJOveur0SShXKcQ7JbRum9GwrxoJfhZs/rt9kmD6YydfWbIx16tudXE6TBUJy3NqNNblvP7ROyCxTPewKg3jfJCz9hdBY66iQeDfbow/DdY11VC3/H4mirV/LNWfTDU79Fosf/b+5Gcn+VntWr2n+vYODZjAe5xIFi2WMsg9+UJ9DlpeCPTQAwpYPE3TLk1vMzjufHfjCEF6ivmSI6uhzKCLMqR5x7cQtkvyVNp2BKzRgWmRJp2Z1cLX4BAAD//wEAAP//GWuHvzUDAAA=" | base64 -d | gzip -d > conf/cluster_spec.yaml
 
-echo "H4sIAAAAAAAA/1SNwY6CMBQA7/2KfgFsdvew22QvsAqYCAZj5Nq0DyW0faWPqvy9MZ64zGHmMLnBqA8Bb4OGILi8E8vR9cMlkwSCW7A9iTRVJtIMgRJ4SOsNJAptqtD6ALSSrHI0S6egCBh9LS0I7lADrUOLBgSvUQN7Ifr3tJR0FbyZ3PTTfexG7VU2xONn7ruyPZmlWn7rr/9p+d6OzXlT9Lj/Y08AAAD//wEAAP//vJRxOMEAAAA=" | base64 -d | gzip -d > conf/kube_env.yaml
+echo "H4sIAAAAAAAA/1SNwUrEMBQA7/mK3IVGobQQ8GIpWqVVq4jXNHlNi0leyGvssl+/LHvqZQ4zh2kcZvOR8H81kCRXO7EGw7zaJ0UguQc/kxRCu0wbJCrgpHx0UGj0QqOPCeggWRdoU0HDc8IcB+VB8oAG6BhGdCD5gAbYFTnepi+KFsn3z6o///7ld/iqdT1CK8BW3z99Ny2lfX3T9Z3Ni57K9uH+kV0AAAD//wEAAP//zlrH9sEAAAA=" | base64 -d | gzip -d > conf/kube_env.yaml
 
 download-release
 echo "== nodeup node config done =="

tests/integration/update_cluster/compress/data/aws_s3_bucket_object_compress.example.com-addons-bootstrap_content

@@ -6,7 +6,7 @@ spec:
   addons:
   - id: k8s-1.16
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: c9bfc2cd926669d6c6fb71abb79fd674fedf4401
+    manifestHash: 022a704b7290ed3eae5aca670f1d080a68abb95f
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:

tests/integration/update_cluster/compress/data/aws_s3_bucket_object_compress.example.com-addons-kops-controller.addons.k8s.io-k8s-1.16_content

@@ -1,7 +1,7 @@
 apiVersion: v1
 data:
   config.yaml: |
-    {"cloud":"aws","configBase":"memfs://clusters.example.com/compress.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.compress.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
+    {"cloud":"aws","configBase":"memfs://clusters.example.com/compress.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.compress.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["kubernetes-ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
 kind: ConfigMap
 metadata:
   creationTimestamp: null

tests/integration/update_cluster/compress/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1a_content

@@ -90,27 +90,6 @@ CAs:
     QdlXZOfmBT6cqxIX/RMHXhpHwRiqPsTO8IO2bVA8CSzxNwMuSv/ZtrMHoh8+PcVW
     HLtkTXH8
     -----END CERTIFICATE-----
-  ca: |
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
-    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
-    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
-    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
-    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
-    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
-    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
-    -----END CERTIFICATE-----
   etcd-clients-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBcjCCARygAwIBAgIMFo1ogHnr26DL9YkqMA0GCSqGSIb3DQEBCwUAMBoxGDAW
@@ -132,12 +111,33 @@ CAs:
     x+PeBDANBgkqhkiG9w0BAQsFAANBAF1xUz77PlUVUnd9duF8F7plou0TONC9R6/E
     YQ8C6vM1b+9NSDGjCW8YmwEU2fBgskb/BBX2lwVZ32/RUEju4Co=
     -----END CERTIFICATE-----
+  kubernetes-ca: |
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
+    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
+    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
+    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
+    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
+    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
+    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
+    -----END CERTIFICATE-----
 ClusterName: compress.example.com
 Hooks:
 - null
 - null
 KeypairIDs:
-  ca: "6976381481633145814258938760"
+  kubernetes-ca: "6976381481633145814258938760"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/compress/data/aws_s3_bucket_object_nodeupconfig-nodes_content

@@ -10,7 +10,7 @@ Assets:
   - ae13d7b5c05bd180ea9b5b68f44bdaa7bfb41034a2ef1d68fd8e1259797d642f@https://storage.googleapis.com/k8s-artifacts-cni/release/v0.8.7/cni-plugins-linux-arm64-v0.8.7.tgz
   - be8c9a5a06ebec8fb1d36e867cd00fb5777746a9812a0cae2966778ff899c525@https://download.docker.com/linux/static/stable/aarch64/docker-20.10.7.tgz
 CAs:
-  ca: |
+  kubernetes-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
     BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw

tests/integration/update_cluster/containerd-custom/cloudformation.json.extracted.yaml

@@ -253,7 +253,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amasterscontainerdexamplecom.Properti
   ConfigBase: memfs://clusters.example.com/containerd.example.com
   InstanceGroupName: master-us-test-1a
   InstanceGroupRole: Master
-  NodeupConfigHash: r8n7f1WmgOPlFchZQbHb43g+eSCoOxfjCmLrk62jB9k=
+  NodeupConfigHash: t64AN1uy9dx8UiIHuJZRp3odNi003Vlcu0W60cVs6Qo=
 
   __EOF_KUBE_ENV
 
@@ -432,7 +432,7 @@ Resources.AWSEC2LaunchTemplatenodescontainerdexamplecom.Properties.LaunchTemplat
   ConfigBase: memfs://clusters.example.com/containerd.example.com
   InstanceGroupName: nodes
   InstanceGroupRole: Node
-  NodeupConfigHash: Ab64gvsOrSiP8RIckMR18Qg8iC26grPkEQ3naplP644=
+  NodeupConfigHash: +KWFzMruxBNiW9yS28DVmT6V/QPlJhXsxoDQfoQbr4A=
 
   __EOF_KUBE_ENV
 

tests/integration/update_cluster/containerd/cloudformation.json.extracted.yaml

@@ -245,7 +245,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amasterscontainerdexamplecom.Properti
   ConfigBase: memfs://clusters.example.com/containerd.example.com
   InstanceGroupName: master-us-test-1a
   InstanceGroupRole: Master
-  NodeupConfigHash: 2gNk5em52Bnxk/MK8sQa5zWLemyC3OYImog3+v+GDQU=
+  NodeupConfigHash: Eo4O9SruHW8gd1y99l8BPAZ9Jh3PTR3w4dasvMBa0m4=
 
   __EOF_KUBE_ENV
 
@@ -416,7 +416,7 @@ Resources.AWSEC2LaunchTemplatenodescontainerdexamplecom.Properties.LaunchTemplat
   ConfigBase: memfs://clusters.example.com/containerd.example.com
   InstanceGroupName: nodes
   InstanceGroupRole: Node
-  NodeupConfigHash: cBd4QiCqh7zjq5xOhJV0c0PUpMekuMOWZDK8XKz8Jt4=
+  NodeupConfigHash: OJlUMSVR3pRz/W+pRCGv6ou0jvqXSoRgFerzQ+o8kbo=
 
   __EOF_KUBE_ENV
 

tests/integration/update_cluster/docker-custom/cloudformation.json.extracted.yaml

@@ -263,7 +263,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersdockerexamplecom.Properties.L
   ConfigBase: memfs://clusters.example.com/docker.example.com
   InstanceGroupName: master-us-test-1a
   InstanceGroupRole: Master
-  NodeupConfigHash: U1FUN5EgqeCFZxtdv3VWAjFME1bbXO1EGjbD0dS/pBU=
+  NodeupConfigHash: mA5rfuULZY17XywOW569LWJZfzetnjn6Xlvjl3F/h2U=
 
   __EOF_KUBE_ENV
 
@@ -451,7 +451,7 @@ Resources.AWSEC2LaunchTemplatenodesdockerexamplecom.Properties.LaunchTemplateDat
   ConfigBase: memfs://clusters.example.com/docker.example.com
   InstanceGroupName: nodes
   InstanceGroupRole: Node
-  NodeupConfigHash: 4kf0pNVgBo7CPqMs66X9wpgiS8RbBqgPJUCmUtz5Shg=
+  NodeupConfigHash: gdXmHnV3g5zzMC+hWr3LXS/Nb9lSZc81YCOfWwdJO3c=
 
   __EOF_KUBE_ENV
 

tests/integration/update_cluster/existing_iam/data/aws_launch_template_master-us-test-1a.masters.existing-iam.example.com_user_data

@@ -244,7 +244,7 @@ CloudProvider: aws
 ConfigBase: memfs://tests/existing-iam.example.com
 InstanceGroupName: master-us-test-1a
 InstanceGroupRole: Master
-NodeupConfigHash: Tsb5T9OVrcRXLqmGRk7c/rSIdYoyuzN+rW46eoVsqS0=
+NodeupConfigHash: OqzOa79QTYvyYlVSCaRRD3/4DqA86b0T5IP0E2Jt4ZM=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/existing_iam/data/aws_launch_template_master-us-test-1b.masters.existing-iam.example.com_user_data

@@ -244,7 +244,7 @@ CloudProvider: aws
 ConfigBase: memfs://tests/existing-iam.example.com
 InstanceGroupName: master-us-test-1b
 InstanceGroupRole: Master
-NodeupConfigHash: Tsb5T9OVrcRXLqmGRk7c/rSIdYoyuzN+rW46eoVsqS0=
+NodeupConfigHash: OqzOa79QTYvyYlVSCaRRD3/4DqA86b0T5IP0E2Jt4ZM=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/existing_iam/data/aws_launch_template_master-us-test-1c.masters.existing-iam.example.com_user_data

@@ -244,7 +244,7 @@ CloudProvider: aws
 ConfigBase: memfs://tests/existing-iam.example.com
 InstanceGroupName: master-us-test-1c
 InstanceGroupRole: Master
-NodeupConfigHash: Tsb5T9OVrcRXLqmGRk7c/rSIdYoyuzN+rW46eoVsqS0=
+NodeupConfigHash: OqzOa79QTYvyYlVSCaRRD3/4DqA86b0T5IP0E2Jt4ZM=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/existing_iam/data/aws_launch_template_nodes.existing-iam.example.com_user_data

@@ -162,7 +162,7 @@ CloudProvider: aws
 ConfigBase: memfs://tests/existing-iam.example.com
 InstanceGroupName: nodes
 InstanceGroupRole: Node
-NodeupConfigHash: VZC55BjxtCEnoftr7zRueq/b4OpzQkEYrZsE9H/zKNE=
+NodeupConfigHash: APwcRn2ofq+3KH4VLXKNIjtoCene9mRIPzpIeeKr18A=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/existing_iam/data/aws_s3_bucket_object_existing-iam.example.com-addons-bootstrap_content

@@ -6,7 +6,7 @@ spec:
   addons:
   - id: k8s-1.16
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 40900d53c6b17aa2cb96e558793e22457093c596
+    manifestHash: 84ceb5800f319b117b4cc50c4769133c59076164
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:

tests/integration/update_cluster/existing_iam/data/aws_s3_bucket_object_existing-iam.example.com-addons-kops-controller.addons.k8s.io-k8s-1.16_content

@@ -1,7 +1,7 @@
 apiVersion: v1
 data:
   config.yaml: |
-    {"cloud":"aws","configBase":"memfs://tests/existing-iam.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["kops-custom-node-role"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
+    {"cloud":"aws","configBase":"memfs://tests/existing-iam.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["kops-custom-node-role"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["kubernetes-ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
 kind: ConfigMap
 metadata:
   creationTimestamp: null

tests/integration/update_cluster/existing_iam/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1a_content

@@ -90,27 +90,6 @@ CAs:
     QdlXZOfmBT6cqxIX/RMHXhpHwRiqPsTO8IO2bVA8CSzxNwMuSv/ZtrMHoh8+PcVW
     HLtkTXH8
     -----END CERTIFICATE-----
-  ca: |
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
-    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
-    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
-    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
-    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
-    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
-    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
-    -----END CERTIFICATE-----
   etcd-clients-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBcjCCARygAwIBAgIMFo1ogHnr26DL9YkqMA0GCSqGSIb3DQEBCwUAMBoxGDAW
@@ -132,12 +111,33 @@ CAs:
     x+PeBDANBgkqhkiG9w0BAQsFAANBAF1xUz77PlUVUnd9duF8F7plou0TONC9R6/E
     YQ8C6vM1b+9NSDGjCW8YmwEU2fBgskb/BBX2lwVZ32/RUEju4Co=
     -----END CERTIFICATE-----
+  kubernetes-ca: |
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
+    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
+    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
+    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
+    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
+    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
+    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
+    -----END CERTIFICATE-----
 ClusterName: existing-iam.example.com
 Hooks:
 - null
 - null
 KeypairIDs:
-  ca: "6976381481633145814258938760"
+  kubernetes-ca: "6976381481633145814258938760"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/existing_iam/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1b_content

@@ -90,27 +90,6 @@ CAs:
     QdlXZOfmBT6cqxIX/RMHXhpHwRiqPsTO8IO2bVA8CSzxNwMuSv/ZtrMHoh8+PcVW
     HLtkTXH8
     -----END CERTIFICATE-----
-  ca: |
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
-    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
-    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
-    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
-    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
-    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
-    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
-    -----END CERTIFICATE-----
   etcd-clients-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBcjCCARygAwIBAgIMFo1ogHnr26DL9YkqMA0GCSqGSIb3DQEBCwUAMBoxGDAW
@@ -132,12 +111,33 @@ CAs:
     x+PeBDANBgkqhkiG9w0BAQsFAANBAF1xUz77PlUVUnd9duF8F7plou0TONC9R6/E
     YQ8C6vM1b+9NSDGjCW8YmwEU2fBgskb/BBX2lwVZ32/RUEju4Co=
     -----END CERTIFICATE-----
+  kubernetes-ca: |
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
+    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
+    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
+    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
+    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
+    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
+    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
+    -----END CERTIFICATE-----
 ClusterName: existing-iam.example.com
 Hooks:
 - null
 - null
 KeypairIDs:
-  ca: "6976381481633145814258938760"
+  kubernetes-ca: "6976381481633145814258938760"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/existing_iam/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1c_content

@@ -90,27 +90,6 @@ CAs:
     QdlXZOfmBT6cqxIX/RMHXhpHwRiqPsTO8IO2bVA8CSzxNwMuSv/ZtrMHoh8+PcVW
     HLtkTXH8
     -----END CERTIFICATE-----
-  ca: |
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
-    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
-    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
-    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
-    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
-    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
-    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
-    -----END CERTIFICATE-----
   etcd-clients-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBcjCCARygAwIBAgIMFo1ogHnr26DL9YkqMA0GCSqGSIb3DQEBCwUAMBoxGDAW
@@ -132,12 +111,33 @@ CAs:
     x+PeBDANBgkqhkiG9w0BAQsFAANBAF1xUz77PlUVUnd9duF8F7plou0TONC9R6/E
     YQ8C6vM1b+9NSDGjCW8YmwEU2fBgskb/BBX2lwVZ32/RUEju4Co=
     -----END CERTIFICATE-----
+  kubernetes-ca: |
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
+    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
+    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
+    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
+    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
+    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
+    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
+    -----END CERTIFICATE-----
 ClusterName: existing-iam.example.com
 Hooks:
 - null
 - null
 KeypairIDs:
-  ca: "6976381481633145814258938760"
+  kubernetes-ca: "6976381481633145814258938760"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/existing_iam/data/aws_s3_bucket_object_nodeupconfig-nodes_content

@@ -10,7 +10,7 @@ Assets:
   - ae13d7b5c05bd180ea9b5b68f44bdaa7bfb41034a2ef1d68fd8e1259797d642f@https://storage.googleapis.com/k8s-artifacts-cni/release/v0.8.7/cni-plugins-linux-arm64-v0.8.7.tgz
   - be8c9a5a06ebec8fb1d36e867cd00fb5777746a9812a0cae2966778ff899c525@https://download.docker.com/linux/static/stable/aarch64/docker-20.10.7.tgz
 CAs:
-  ca: |
+  kubernetes-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
     BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw

tests/integration/update_cluster/existing_iam_cloudformation/cloudformation.json.extracted.yaml

@@ -245,7 +245,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersminimalexamplecom.Properties.
   ConfigBase: memfs://clusters.example.com/minimal.example.com
   InstanceGroupName: master-us-test-1a
   InstanceGroupRole: Master
-  NodeupConfigHash: 771Tsn/zswRcxhYR9hrk4Y6YoYw8lnfjTYP5nPCevWQ=
+  NodeupConfigHash: i+WeH5XrtTgKnN/2fnD0X/Bch2NxQy0zsSl0Fztjmy4=
 
   __EOF_KUBE_ENV
 
@@ -416,7 +416,7 @@ Resources.AWSEC2LaunchTemplatenodesminimalexamplecom.Properties.LaunchTemplateDa
   ConfigBase: memfs://clusters.example.com/minimal.example.com
   InstanceGroupName: nodes
   InstanceGroupRole: Node
-  NodeupConfigHash: Exh/JxdKlfAU6pw0iJJklgc7kZM7tKyVYIBYXUaPaz4=
+  NodeupConfigHash: Iaffzj3I5NOIlGIOxaImUn0St+IMyJDYd9fwt4SurfI=
 
   __EOF_KUBE_ENV
 

tests/integration/update_cluster/existing_sg/data/aws_launch_template_master-us-test-1a.masters.existingsg.example.com_user_data

@@ -244,7 +244,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/existingsg.example.com
 InstanceGroupName: master-us-test-1a
 InstanceGroupRole: Master
-NodeupConfigHash: ie0/u2SJu5WIOWsdZMWTSdS2dqnXTygmFNqg1mUF324=
+NodeupConfigHash: O7iUtTpEYJqjkbj5XqKgwiIxABVjiKV2YFT8PJlrTBQ=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/existing_sg/data/aws_launch_template_master-us-test-1b.masters.existingsg.example.com_user_data

@@ -244,7 +244,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/existingsg.example.com
 InstanceGroupName: master-us-test-1b
 InstanceGroupRole: Master
-NodeupConfigHash: ie0/u2SJu5WIOWsdZMWTSdS2dqnXTygmFNqg1mUF324=
+NodeupConfigHash: O7iUtTpEYJqjkbj5XqKgwiIxABVjiKV2YFT8PJlrTBQ=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/existing_sg/data/aws_launch_template_master-us-test-1c.masters.existingsg.example.com_user_data

@@ -244,7 +244,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/existingsg.example.com
 InstanceGroupName: master-us-test-1c
 InstanceGroupRole: Master
-NodeupConfigHash: ie0/u2SJu5WIOWsdZMWTSdS2dqnXTygmFNqg1mUF324=
+NodeupConfigHash: O7iUtTpEYJqjkbj5XqKgwiIxABVjiKV2YFT8PJlrTBQ=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/existing_sg/data/aws_launch_template_nodes.existingsg.example.com_user_data

@@ -162,7 +162,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/existingsg.example.com
 InstanceGroupName: nodes
 InstanceGroupRole: Node
-NodeupConfigHash: 6wJBkZwCUcIEtbnZDkVbkwPPfqUmvO6Cmjm8DoaMuXs=
+NodeupConfigHash: dIt07GPjyvSlEku0ex91PTycwpsqfz+KgSCfvs5nxDA=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/existing_sg/data/aws_s3_bucket_object_existingsg.example.com-addons-bootstrap_content

@@ -6,7 +6,7 @@ spec:
   addons:
   - id: k8s-1.16
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: 7bda6d31ef86dd97b40140afd55b92e57c9d2907
+    manifestHash: eaeb0c1f68113895d9bb6d059ae24f46fac4278e
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:

tests/integration/update_cluster/existing_sg/data/aws_s3_bucket_object_existingsg.example.com-addons-kops-controller.addons.k8s.io-k8s-1.16_content

@@ -1,7 +1,7 @@
 apiVersion: v1
 data:
   config.yaml: |
-    {"cloud":"aws","configBase":"memfs://clusters.example.com/existingsg.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.existingsg.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
+    {"cloud":"aws","configBase":"memfs://clusters.example.com/existingsg.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.existingsg.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["kubernetes-ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
 kind: ConfigMap
 metadata:
   creationTimestamp: null

tests/integration/update_cluster/existing_sg/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1a_content

@@ -90,27 +90,6 @@ CAs:
     QdlXZOfmBT6cqxIX/RMHXhpHwRiqPsTO8IO2bVA8CSzxNwMuSv/ZtrMHoh8+PcVW
     HLtkTXH8
     -----END CERTIFICATE-----
-  ca: |
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
-    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
-    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
-    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
-    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
-    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
-    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
-    -----END CERTIFICATE-----
   etcd-clients-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBcjCCARygAwIBAgIMFo1ogHnr26DL9YkqMA0GCSqGSIb3DQEBCwUAMBoxGDAW
@@ -132,12 +111,33 @@ CAs:
     x+PeBDANBgkqhkiG9w0BAQsFAANBAF1xUz77PlUVUnd9duF8F7plou0TONC9R6/E
     YQ8C6vM1b+9NSDGjCW8YmwEU2fBgskb/BBX2lwVZ32/RUEju4Co=
     -----END CERTIFICATE-----
+  kubernetes-ca: |
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
+    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
+    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
+    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
+    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
+    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
+    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
+    -----END CERTIFICATE-----
 ClusterName: existingsg.example.com
 Hooks:
 - null
 - null
 KeypairIDs:
-  ca: "6976381481633145814258938760"
+  kubernetes-ca: "6976381481633145814258938760"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/existing_sg/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1b_content

@@ -90,27 +90,6 @@ CAs:
     QdlXZOfmBT6cqxIX/RMHXhpHwRiqPsTO8IO2bVA8CSzxNwMuSv/ZtrMHoh8+PcVW
     HLtkTXH8
     -----END CERTIFICATE-----
-  ca: |
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
-    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
-    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
-    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
-    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
-    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
-    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
-    -----END CERTIFICATE-----
   etcd-clients-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBcjCCARygAwIBAgIMFo1ogHnr26DL9YkqMA0GCSqGSIb3DQEBCwUAMBoxGDAW
@@ -132,12 +111,33 @@ CAs:
     x+PeBDANBgkqhkiG9w0BAQsFAANBAF1xUz77PlUVUnd9duF8F7plou0TONC9R6/E
     YQ8C6vM1b+9NSDGjCW8YmwEU2fBgskb/BBX2lwVZ32/RUEju4Co=
     -----END CERTIFICATE-----
+  kubernetes-ca: |
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
+    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
+    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
+    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
+    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
+    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
+    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
+    -----END CERTIFICATE-----
 ClusterName: existingsg.example.com
 Hooks:
 - null
 - null
 KeypairIDs:
-  ca: "6976381481633145814258938760"
+  kubernetes-ca: "6976381481633145814258938760"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/existing_sg/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1c_content

@@ -90,27 +90,6 @@ CAs:
     QdlXZOfmBT6cqxIX/RMHXhpHwRiqPsTO8IO2bVA8CSzxNwMuSv/ZtrMHoh8+PcVW
     HLtkTXH8
     -----END CERTIFICATE-----
-  ca: |
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
-    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
-    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
-    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
-    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
-    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
-    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
-    -----END CERTIFICATE-----
   etcd-clients-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBcjCCARygAwIBAgIMFo1ogHnr26DL9YkqMA0GCSqGSIb3DQEBCwUAMBoxGDAW
@@ -132,12 +111,33 @@ CAs:
     x+PeBDANBgkqhkiG9w0BAQsFAANBAF1xUz77PlUVUnd9duF8F7plou0TONC9R6/E
     YQ8C6vM1b+9NSDGjCW8YmwEU2fBgskb/BBX2lwVZ32/RUEju4Co=
     -----END CERTIFICATE-----
+  kubernetes-ca: |
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
+    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
+    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
+    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
+    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
+    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
+    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
+    -----END CERTIFICATE-----
 ClusterName: existingsg.example.com
 Hooks:
 - null
 - null
 KeypairIDs:
-  ca: "6976381481633145814258938760"
+  kubernetes-ca: "6976381481633145814258938760"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/existing_sg/data/aws_s3_bucket_object_nodeupconfig-nodes_content

@@ -10,7 +10,7 @@ Assets:
   - ae13d7b5c05bd180ea9b5b68f44bdaa7bfb41034a2ef1d68fd8e1259797d642f@https://storage.googleapis.com/k8s-artifacts-cni/release/v0.8.7/cni-plugins-linux-arm64-v0.8.7.tgz
   - be8c9a5a06ebec8fb1d36e867cd00fb5777746a9812a0cae2966778ff899c525@https://download.docker.com/linux/static/stable/aarch64/docker-20.10.7.tgz
 CAs:
-  ca: |
+  kubernetes-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
     BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw

tests/integration/update_cluster/externallb/cloudformation.json.extracted.yaml

@@ -245,7 +245,7 @@ Resources.AWSEC2LaunchTemplatemasterustest1amastersexternallbexamplecom.Properti
   ConfigBase: memfs://clusters.example.com/externallb.example.com
   InstanceGroupName: master-us-test-1a
   InstanceGroupRole: Master
-  NodeupConfigHash: ZNIuKFTSR108RH3NayH7I2M18dcu/+Y3I7riMTONdwo=
+  NodeupConfigHash: 3cMbe5tyCfF6qwMOwp71ax0f7NRRYRnI3LLh8/9C29g=
 
   __EOF_KUBE_ENV
 
@@ -416,7 +416,7 @@ Resources.AWSEC2LaunchTemplatenodesexternallbexamplecom.Properties.LaunchTemplat
   ConfigBase: memfs://clusters.example.com/externallb.example.com
   InstanceGroupName: nodes
   InstanceGroupRole: Node
-  NodeupConfigHash: Lfxu5NMRY4Sg3and75Zl4aY/NU71FhLC9Un02ivap6Q=
+  NodeupConfigHash: noyeTBsnjjwBOnC52diacjiFw8fjisoGRR0zsb348X0=
 
   __EOF_KUBE_ENV
 

tests/integration/update_cluster/externallb/data/aws_launch_template_master-us-test-1a.masters.externallb.example.com_user_data

@@ -244,7 +244,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/externallb.example.com
 InstanceGroupName: master-us-test-1a
 InstanceGroupRole: Master
-NodeupConfigHash: ZNIuKFTSR108RH3NayH7I2M18dcu/+Y3I7riMTONdwo=
+NodeupConfigHash: 3cMbe5tyCfF6qwMOwp71ax0f7NRRYRnI3LLh8/9C29g=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/externallb/data/aws_launch_template_nodes.externallb.example.com_user_data

@@ -162,7 +162,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/externallb.example.com
 InstanceGroupName: nodes
 InstanceGroupRole: Node
-NodeupConfigHash: Lfxu5NMRY4Sg3and75Zl4aY/NU71FhLC9Un02ivap6Q=
+NodeupConfigHash: noyeTBsnjjwBOnC52diacjiFw8fjisoGRR0zsb348X0=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/externallb/data/aws_s3_bucket_object_externallb.example.com-addons-bootstrap_content

@@ -6,7 +6,7 @@ spec:
   addons:
   - id: k8s-1.16
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: a10f82d93dee3ba1c29c83c4b77b2534f0d4439e
+    manifestHash: 337bda87e416ef3a0238a83a52cad865f25bcaff
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:

tests/integration/update_cluster/externallb/data/aws_s3_bucket_object_externallb.example.com-addons-kops-controller.addons.k8s.io-k8s-1.16_content

@@ -1,7 +1,7 @@
 apiVersion: v1
 data:
   config.yaml: |
-    {"cloud":"aws","configBase":"memfs://clusters.example.com/externallb.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.externallb.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
+    {"cloud":"aws","configBase":"memfs://clusters.example.com/externallb.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.externallb.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["kubernetes-ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
 kind: ConfigMap
 metadata:
   creationTimestamp: null

tests/integration/update_cluster/externallb/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1a_content

@@ -90,27 +90,6 @@ CAs:
     QdlXZOfmBT6cqxIX/RMHXhpHwRiqPsTO8IO2bVA8CSzxNwMuSv/ZtrMHoh8+PcVW
     HLtkTXH8
     -----END CERTIFICATE-----
-  ca: |
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
-    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
-    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
-    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
-    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
-    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
-    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
-    -----END CERTIFICATE-----
   etcd-clients-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBcjCCARygAwIBAgIMFo1ogHnr26DL9YkqMA0GCSqGSIb3DQEBCwUAMBoxGDAW
@@ -132,12 +111,33 @@ CAs:
     x+PeBDANBgkqhkiG9w0BAQsFAANBAF1xUz77PlUVUnd9duF8F7plou0TONC9R6/E
     YQ8C6vM1b+9NSDGjCW8YmwEU2fBgskb/BBX2lwVZ32/RUEju4Co=
     -----END CERTIFICATE-----
+  kubernetes-ca: |
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
+    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
+    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
+    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
+    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
+    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
+    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
+    -----END CERTIFICATE-----
 ClusterName: externallb.example.com
 Hooks:
 - null
 - null
 KeypairIDs:
-  ca: "6976381481633145814258938760"
+  kubernetes-ca: "6976381481633145814258938760"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/externallb/data/aws_s3_bucket_object_nodeupconfig-nodes_content

@@ -10,7 +10,7 @@ Assets:
   - ae13d7b5c05bd180ea9b5b68f44bdaa7bfb41034a2ef1d68fd8e1259797d642f@https://storage.googleapis.com/k8s-artifacts-cni/release/v0.8.7/cni-plugins-linux-arm64-v0.8.7.tgz
   - be8c9a5a06ebec8fb1d36e867cd00fb5777746a9812a0cae2966778ff899c525@https://download.docker.com/linux/static/stable/aarch64/docker-20.10.7.tgz
 CAs:
-  ca: |
+  kubernetes-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
     BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw

tests/integration/update_cluster/externalpolicies/data/aws_launch_template_master-us-test-1a.masters.externalpolicies.example.com_user_data

@@ -246,7 +246,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/externalpolicies.example.com
 InstanceGroupName: master-us-test-1a
 InstanceGroupRole: Master
-NodeupConfigHash: L/e+qS/NBSF5l3mjWb+P1T8vBxhJ0jj8Gh34EMJzCj0=
+NodeupConfigHash: XkYl8sg/QWRMNxrt8LBrtcA2xXnhrsOYhkOHrU7YI4E=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/externalpolicies/data/aws_launch_template_nodes.externalpolicies.example.com_user_data

@@ -162,7 +162,7 @@ CloudProvider: aws
 ConfigBase: memfs://clusters.example.com/externalpolicies.example.com
 InstanceGroupName: nodes
 InstanceGroupRole: Node
-NodeupConfigHash: Mt0HOMOTCLeyh/NarGYwQJz4vpHP9zns4uQ4nK4nScc=
+NodeupConfigHash: ttdcBvia/2PKvI31kMzLxkSVh84c+hRQ7Iihhk4cztk=
 
 __EOF_KUBE_ENV
 

tests/integration/update_cluster/externalpolicies/data/aws_s3_bucket_object_externalpolicies.example.com-addons-bootstrap_content

@@ -6,7 +6,7 @@ spec:
   addons:
   - id: k8s-1.16
     manifest: kops-controller.addons.k8s.io/k8s-1.16.yaml
-    manifestHash: cbe16d3e9b8bf304ac0329d42d5b14978206b187
+    manifestHash: ffb7b2b3b15267e1fe0b98118c37212f58941fd0
     name: kops-controller.addons.k8s.io
     needsRollingUpdate: control-plane
     selector:

tests/integration/update_cluster/externalpolicies/data/aws_s3_bucket_object_externalpolicies.example.com-addons-kops-controller.addons.k8s.io-k8s-1.16_content

@@ -1,7 +1,7 @@
 apiVersion: v1
 data:
   config.yaml: |
-    {"cloud":"aws","configBase":"memfs://clusters.example.com/externalpolicies.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.externalpolicies.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
+    {"cloud":"aws","configBase":"memfs://clusters.example.com/externalpolicies.example.com","server":{"Listen":":3988","provider":{"aws":{"nodesRoles":["nodes.externalpolicies.example.com"],"Region":"us-test-1"}},"serverKeyPath":"/etc/kubernetes/kops-controller/pki/kops-controller.key","serverCertificatePath":"/etc/kubernetes/kops-controller/pki/kops-controller.crt","caBasePath":"/etc/kubernetes/kops-controller/pki","signingCAs":["kubernetes-ca"],"certNames":["kubelet","kubelet-server","kube-proxy"]}}
 kind: ConfigMap
 metadata:
   creationTimestamp: null

tests/integration/update_cluster/externalpolicies/data/aws_s3_bucket_object_nodeupconfig-master-us-test-1a_content

@@ -92,27 +92,6 @@ CAs:
     QdlXZOfmBT6cqxIX/RMHXhpHwRiqPsTO8IO2bVA8CSzxNwMuSv/ZtrMHoh8+PcVW
     HLtkTXH8
     -----END CERTIFICATE-----
-  ca: |
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
-    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
-    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
-    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
-    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
-    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
-    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
-    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
-    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
-    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
-    -----END CERTIFICATE-----
   etcd-clients-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBcjCCARygAwIBAgIMFo1ogHnr26DL9YkqMA0GCSqGSIb3DQEBCwUAMBoxGDAW
@@ -134,12 +113,33 @@ CAs:
     x+PeBDANBgkqhkiG9w0BAQsFAANBAF1xUz77PlUVUnd9duF8F7plou0TONC9R6/E
     YQ8C6vM1b+9NSDGjCW8YmwEU2fBgskb/BBX2lwVZ32/RUEju4Co=
     -----END CERTIFICATE-----
+  kubernetes-ca: |
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    ANiW3hfHTcKnxCig+uWhpVbOfH1pANKmXVSysPKgE80QSU4tZ6m49pAEeIMsvwvD
+    MaLsb2v6JvXe0qvCmueU+/sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFCOW3hR7ngBsk9aUOlEznWzH494EMA0GCSqG
+    SIb3DQEBCwUAA0EAVnZzkiku07kQFGAEXzWI6aZnAbzSoClYskEzCBMrOmdadjVp
+    VWcz76FwFlyd5jhzOJ49eMcVusSotKv2ZGimcA==
+    -----END CERTIFICATE-----
+    -----BEGIN CERTIFICATE-----
+    MIIBaDCCARKgAwIBAgIMFoq6PeyECsgUTfc2MA0GCSqGSIb3DQEBCwUAMBUxEzAR
+    BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw
+    WjAVMRMwEQYDVQQDEwprdWJlcm5ldGVzMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
+    AKOE64nZbH+GM91AIrqf7HEk4hvzqsZFFtxc+8xir1XC3mI/RhCCrs6AdVRZNZ26
+    A6uHArhi33c2kHQkCjyLA7sCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+    EwEB/wQFMAMBAf8wHQYDVR0OBBYEFIT28RJlG8FTgmvn2YMa3hYX+u1BMA0GCSqG
+    SIb3DQEBCwUAA0EAKuaE5wKMP26AyfxkWu83iHoTPFtdjabXF0JcyPy0ijQZxfJq
+    9xc2CkttvgaDtT4H+E/ryQ3iq6kSfEYYPi8c0w==
+    -----END CERTIFICATE-----
 ClusterName: externalpolicies.example.com
 Hooks:
 - null
 - null
 KeypairIDs:
-  ca: "6976381481633145814258938760"
+  kubernetes-ca: "6976381481633145814258938760"
 KubeletConfig:
   anonymousAuth: false
   cgroupDriver: systemd

tests/integration/update_cluster/externalpolicies/data/aws_s3_bucket_object_nodeupconfig-nodes_content

@@ -10,7 +10,7 @@ Assets:
   - ae13d7b5c05bd180ea9b5b68f44bdaa7bfb41034a2ef1d68fd8e1259797d642f@https://storage.googleapis.com/k8s-artifacts-cni/release/v0.8.7/cni-plugins-linux-arm64-v0.8.7.tgz
   - be8c9a5a06ebec8fb1d36e867cd00fb5777746a9812a0cae2966778ff899c525@https://download.docker.com/linux/static/stable/aarch64/docker-20.10.7.tgz
 CAs:
-  ca: |
+  kubernetes-ca: |
     -----BEGIN CERTIFICATE-----
     MIIBaDCCARKgAwIBAgIMFoq6Pex4lTCM8fOIMA0GCSqGSIb3DQEBCwUAMBUxEzAR
     BgNVBAMTCmt1YmVybmV0ZXMwHhcNMjEwNjE5MjI0MzEwWhcNMzEwNjE5MjI0MzEw