Openunison/Kubernetes Cert Issues about openunison-k8s-login-oidc HOT 2 CLOSED

I was able to get this resolved using the first link specified. Thanks for help.

from openunison-k8s-login-oidc.

using f5 to point to an nginx ingress controller

Is your F5 hosting your certificate or is is just passing through the packets? If it's hosting the certificate, did you take a look at https://github.com/TremoloSecurity/OpenUnison/wiki/troubleshooting#how-do-i-change-openunisons-certificates ?

2021-05-04T18:17:30.804696725Z javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I suspect this answers my question that your F5 is a TLS termination point so the dashboard can't "federate" with the openunison host because your F5 cert isn't trusted by openunison. If your F5 certificate is from an internal CA, use the instructions above. If it's signed by a commercial CA - https://github.com/TremoloSecurity/OpenUnison/wiki/troubleshooting#using-a-commercially-signed-ingress-certificate

Unable to connect to the server: Get "https://tsb-kube-auth.yosemite.local/auth/idp/k8sIdp/.well-known/openid-configuration": x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0

My guess is if you look at your F5's certificate you'll see that it doesn't have a subject alternative name. You might need to create GODEBUG=x509ignoreCN=0 as an environment variable before running kubectl.

from openunison-k8s-login-oidc.