append router-ca to kubeconfig

crt-append.sh

#!/usr/bin/env bash

set -o errexit
set -o nounset
set -o pipefail

####################################################################################
# This is no longer required, only the idp.sh is required to configure htpasswd idp
# HOWEVER, if your install fails and cluster is functional enough to configure 
# idp and/or login with kubeadmin, you'll need to run this to avoid x509 error
####################################################################################
# get encoded data
oc get secret router-ca -n openshift-ingress-operator -o yaml | grep tls.crt | awk -F ': ' '{print $2}' > /tmp/router-ca.enc
cat "$KUBECONFIG" | grep certificate-authority-data | head -1 | awk -F ': ' '{print $2}' > /tmp/cluster-ca.enc

# decode data
base64 --decode /tmp/router-ca.enc > /tmp/router-ca.decoded
base64 --decode /tmp/cluster-ca.enc > /tmp/cluster-ca.decoded

# append router-ca to cluster-ca
cat /tmp/router-ca.decoded /tmp/cluster-ca.decoded > /tmp/bundle.decoded

#encode new bundle
base64 -w 0 /tmp/bundle.decoded > /tmp/bundle.encoded

#replace certificate-authority-data in kubeconfig with new encoded bundle
export BUNDLE=$(cat /tmp/bundle.encoded)
sed -i.bak "s|certificate-authority-data.*|certificate-authority-data: $BUNDLE|g" "$KUBECONFIG"

@richm awesome, thank you!