Unable connect to apiserver due to "x509: certificate signed by unknown authority" after specifying the --apiserver-host

[Shuanglu]

Is this a request for help? (If yes, you should use our troubleshooting guide and community support channels, see https://kubernetes.io/docs/tasks/debug-application-cluster/troubleshooting/.):
N/A
What keywords did you search in NGINX Ingress controller issues before filing this one? (If you have found any duplicates, you should instead reply there.):
--apiserver-host

Is this a BUG REPORT or FEATURE REQUEST? (choose one):
BUG

NGINX Ingress controller version:
quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1

Kubernetes version (use kubectl version):
1.14.7

Environment:
AKS

• Cloud provider or hardware configuration:
  Azure
• OS (e.g. from /etc/os-release):
  Ubuntu 16.04.6 LTS
• Kernel (e.g. uname -a):
  4.15.0-1063-azure
• Install tools:
  manually
  https://kubernetes.github.io/ingress-nginx/deploy/#prerequisite-generic-deployment-command
• Others:
  N/A

What happened:
I tried to add the command '--apiserver-host=https://testslaks-dns-7fbdb13b.hcp.eastus.azmk8s.io' to the command line but the pod cannot start due to 'x509: certificate signed by unknown authority'
The ca/token in the service account mounted to the container is good.
What you expected to happen:
the container can start after specifying '--apiserver-host'

How to reproduce it (as minimally and precisely as possible):
Add the command to the nginx ingress controller yaml file and deploy it
https://kubernetes.github.io/ingress-nginx/deploy/#prerequisite-generic-deployment-command

Anything else we need to know:
N/A

[aledbf]

The issue here is related to client-go library where an external URL is configured, a valid SSL certificate is expected and the ca.crt file from the service account is not used

https://github.com/kubernetes/ingress-nginx/blob/master/cmd/nginx/main.go#L177

[aledbf]

@Shuanglu not sure this if this workaround works, but you can try to add the next two environment variables to the ingress controller deployment:

KUBERNETES_SERVICE_HOST=testslaks-dns-7fbdb13b.hcp.eastus.azmk8s.io
KUBERNETES_SERVICE_PORT=443

[Shuanglu]

KUBERNETES_SERVICE_HOST

Thanks. The workaround works. Hopefully it can be fixed in the future.