CoreDNS + Kubernetes question:
CoreDNS, in its stock configuration, assumes/uses the default service created for the Kubernetes API.
However, this gets a ClusterIP from the cluster's Service IP range as part of normal IPAM.
This IP is not known to the operating system or during cluster setup, so isn't in the IP SANs for the TLS certificate. This causes CoreDNS to error out trusting the Kubernetes API when trying to watch services.
The the default Kubernetes service is roughly well-known as it's the bottom of the service IP range + 1 but that still feels... odd.
I looked into automatic in-cluster certificate management and rotation but that seems more about Kubelet client certificates for the API server, and none of the actual TLS certificates. Which kinda makes sense cause otherwise cyclic dependencies.
https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/#coredns-configmap-options