Configure the Kubernetes API to access Dex as OpenID connect provider

[jackchuong]

Hi all,
I'm following this instruction https://computingforgeeks.com/active-directory-authentication-for-kubernetes-kubectl/ to config Active Directory Authentication for Kubernetes.
My k8s cluster init from : kubeadm init --v=5 --pod-network-cidr=10.244.0.0/16 --cri-socket unix:///run/cri-dockerd.sock --upload-certs --control-plane-endpoint=k8s.mydomain.com
I deployed DEX on Kubernetes successfully , issuer url https://auth.k8s.mydomain.com , tls certificate is generated from cert-manager , url is public to external through ingress-nginx , I can access url from internet.
Now I want to configure the Kubernetes API to access Dex as OpenID connect provider, how should I edit /etc/kubernetes/manifests/kube-apiserver.yaml ?

## ADD these lines

    - --oidc-issuer-url=https://auth.k8s.mydomain.com/
    - --oidc-client-id=oidc-auth-client  ##ENSURE THE WILDCARD CERTIFICATES ARE PRESENT IN THIS FILE PATH IN ALL MASTER NODES: 
    - --oidc-ca-file=/etc/ssl/kubernetes/kubernetes.mydomain.com.crt    
    - --oidc-username-claim=email
    - --oidc-groups-claim=groups

I concert about "--oidc-ca-file="
this is my /etc/kubernetes/pki/

ls -lah /etc/kubernetes/pki/
total 68K
drwxr-xr-x 3 root root 4.0K Mar 17 12:37 .
drwxr-xr-x 4 root root 4.0K Mar 17 12:37 ..
-rw-r--r-- 1 root root 1.3K Mar 17 12:37 apiserver.crt
-rw-r--r-- 1 root root 1.2K Mar 17 12:37 apiserver-etcd-client.crt
-rw------- 1 root root 1.7K Mar 17 12:37 apiserver-etcd-client.key
-rw------- 1 root root 1.7K Mar 17 12:37 apiserver.key
-rw-r--r-- 1 root root 1.2K Mar 17 12:37 apiserver-kubelet-client.crt
-rw------- 1 root root 1.7K Mar 17 12:37 apiserver-kubelet-client.key
-rw-r--r-- 1 root root 1.1K Mar 17 12:37 ca.crt
-rw------- 1 root root 1.7K Mar 17 12:37 ca.key
drwxr-xr-x 2 root root 4.0K Mar 17 12:37 etcd
-rw-r--r-- 1 root root 1.1K Mar 17 12:37 front-proxy-ca.crt
-rw------- 1 root root 1.7K Mar 17 12:37 front-proxy-ca.key
-rw-r--r-- 1 root root 1.1K Mar 17 12:37 front-proxy-client.crt
-rw------- 1 root root 1.7K Mar 17 12:37 front-proxy-client.key
-rw------- 1 root root 1.7K Mar 17 12:37 sa.key
-rw------- 1 root root  451 Mar 17 12:37 sa.pub

[jackchuong]

I read another article https://github.com/jimangel/kubernetes-the-easy-way/blob/master/docs/setup-dex-oidc.md
Then I go to https://letsencrypt.org/certificates/ and pick information I need

curl https://letsencrypt.org/certs/isrgrootx1.pem > isrgrootx1.pem
curl https://letsencrypt.org/certs/lets-encrypt-r3.pem > lets-encrypt-r3.pem
cat isrgrootx1.pem lets-encrypt-r3.pem > letsencrypt.pem
cp letsencrypt.pem /etc/kubernetes/pki/letsencrypt.pem

vim /etc/kubernetes/manifests/kube-apiserver.yaml
## ADD these lines

    - --oidc-issuer-url=https://auth.k8s.mydomain.com/
    - --oidc-client-id=oidc-auth-client  ##ENSURE THE WILDCARD CERTIFICATES ARE PRESENT IN THIS FILE PATH IN ALL MASTER NODES: 
    - --oidc-ca-file=/etc/kubernetes/pki/letsencrypt.pem  
    - --oidc-username-claim=email
    - --oidc-groups-claim=groups

I'm not sure if it works ?