Allow for custom CA to be installed in api/auth pods

[josemaia]

What would you like to be added?

Hi,

I would like to be able to customize (for example, via mounting a configmap) the certificates that the API and Auth pods are using to connect to the Kubernetes API. In my current use case, we use kube-oidc-proxy as a proxy between all our clusters and Keycloak, which has the SSO information needed for the Kubernetes Dashboard users to properly authenticate and get their authorization details to interact with the underlying Kubernetes API.

However, kube-oidc-proxy is secured by a TLS certificate internally (i.e. in the Service) as well as externally (through the Ingress), both of which are signed by an untrusted authority (the internal cert is auto generated, and the external one with a private CA that would need to be installed in the containers).

As far as I can tell, the only certificate configurations are for the API and the Web containers to expose their HTTP layers with a specific certificate, but there is no way to allow installation of custom certs for Kubernetes API access. The workaround is fully disabling TLS verification on these pods by using --apiserver-skip-tls-verify, but that could expose us to MITM attacks.

Why is this needed?

Would allow usage of kube-oidc-proxy or other scenarios where the Kubernetes API is accessed with a custom certificate chain.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[josemaia]

/remove-lifecycle stale

[josemaia]

started a branch to look into this but not sure i will have the time to fully fix it 😆 at least the scaffolding is there if anyone wants to take a look

master...josemaia:dashboard:feature/custom-bundle