custom certificate cannot be used

[guhuajun]

Environment

Installation method: https://github.com/kubernetes/dashboard/blob/master/docs/user/installation.md#recommended-setup
Kubernetes version: v1.15.0
Dashboard version: 2.0.0-beta5
Operating system: CentOS 7.6.1810
Node.js version ('node --version' output): n/a
Go version ('go version' output): n/a

Steps to reproduce

Note: I am verifying the possibility for using certificates that are enrolled by Microsoft Enterprise CA.

1. Using following steps to get certificate from enterprise ca. Citrix Doc (Running commands via cmder on a Windows utility server, certreq is a windows command line tool.)

openssl req -newkey rsa:2048 -keyout dashboard_key.pem -nodes -out dashboard.req -subj "/CN=dashboard.test.contoso.com"
certreq -submit -binary -attrib "CertificateTemplate:K8SDashboard" -config ca01.corp.contoso.com\rootca dashboard.req dashboard.cer 
openssl x509 -inform der -in dashboard.cer -out dashboard.pem
openssl pkcs12 -export -inkey dashboard_key.pem -in dashboard.pem -out dashboard.pfx -passout pass:changeme
openssl pkcs12 -in dashboard.pfx -out dashboard_keypair.pem -nodes -password pass:changeme
openssl pkcs12 -in dashboard.pfx -clcerts -nokeys -out dashboard.crt

2. SCP cert files to server and run following command.

kubectl create secret generic kubernetes-dashboard-certs --from-file=$HOME/certs -n kubernetes-dashboard

3. Run following command.

kubectl create -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta5/aio/deploy/recommended.yaml

Observed result

Still using a self-signed certificate.

Expected result

A certificate that enrolled by enterprise ca should be used.

Comments

1. Is it the right time to use 2.0.0-beta5?
2. Should --auto-generate-certificates be commented out?
3. I can confirm the certificate is imported to k8s correctly.
   

[floreks]

https://github.com/kubernetes/dashboard/blob/master/docs/common/dashboard-arguments.md

You have to change the deployment remove auto-generate-certificates and provide tls-cert-file and tls-key-file arguments.

/close

[k8s-ci-robot]

@floreks: Closing this issue.

Details

In response to this:

https://github.com/kubernetes/dashboard/blob/master/docs/common/dashboard-arguments.md

You have to change the deployment remove auto-generate-certificates and provide tls-cert-file and tls-key-file arguments.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[guhuajun]

@floreks Thank you for your super fast response. I can confirm it work as expected.