Rename k3s-controller based on the build-time program name

pkg/agent/netpol/network_policy.go

@@ -32,7 +32,8 @@ func Run(ctx context.Context, nodeConfig *config.Node) error {
 		return err
 	}
 
-	// retry backoff to wait for the clusterrolebinding of user "system:k3s-controller"
+	// retry backoff to wait for the clusterrolebinding for the k3s tunnel controller (system:k3s-controller or equivalent)
+	// which has to occur before it can bring up the connection to the API server.
 	retryBackoff := wait.Backoff{
 		Steps:    6,
 		Duration: 100 * time.Millisecond,

pkg/daemons/control/server.go

@@ -551,8 +551,8 @@ func genClientCerts(config *config.Control, runtime *config.ControlRuntime) erro
 	if _, err = factory("system:kube-proxy", nil, runtime.ClientKubeProxyCert, runtime.ClientKubeProxyKey); err != nil {
 		return err
 	}
-	// this must be hardcoded to k3s-controller because it's hard coded in the rolebindings.yaml
-	if _, err = factory("system:k3s-controller", nil, runtime.ClientK3sControllerCert, runtime.ClientK3sControllerKey); err != nil {
+	// This user (system:k3s-controller by default) must be bound to a role in rolebindings.yaml or the downstream equivalent
+	if _, err = factory("system:"+version.Program+"-controller", nil, runtime.ClientK3sControllerCert, runtime.ClientK3sControllerKey); err != nil {
 		return err
 	}