From c22fdec4539f0db1e25ce6248769cc94ebec02c1 Mon Sep 17 00:00:00 2001
From: Michael Nelson <mnelson@bitnami.com>
Date: Thu, 14 Nov 2019 10:33:46 +1100
Subject: [PATCH] Local oauth dev with dex (#1285)

* Initial local deploy on kind with oidc/dex

* Move user rbac to file.

* Wait for api server before updating /etc/hosts

* kubeapps-user only has access to kubeapps-user-namespace
---
 Makefile                                      |  1 +
 .../kubeapps-local-dev-apiserver-config.json  |  6 +-
 .../kubeapps-local-dev-auth-proxy-values.yaml | 10 ++
 .../kubeapps-local-dev-dex-values.yaml        | 27 +++++
 .../kubeapps-local-dev-tiller-rbac.yaml       | 19 ++++
 .../kubeapps-local-dev-users-rbac.yaml        | 34 +++++++
 script/cluster-kind.mk                        |  3 +-
 script/deploy-dev.mk                          | 52 ++++++++++
 script/test-certs/ca.cert.pem                 | 55 +++++------
 script/test-certs/dex.cert.pem                | 51 +++++-----
 script/test-certs/dex.key.pem                 | 98 +++++++++----------
 script/test-certs/gen-certs.sh                |  5 +-
 script/test-certs/helm.cert.pem               | 51 +++++-----
 script/test-certs/helm.key.pem                | 98 +++++++++----------
 script/test-certs/tiller.cert.pem             | 51 +++++-----
 script/test-certs/tiller.key.pem              | 98 +++++++++----------
 16 files changed, 399 insertions(+), 260 deletions(-)
 create mode 100644 docs/user/manifests/kubeapps-local-dev-auth-proxy-values.yaml
 create mode 100644 docs/user/manifests/kubeapps-local-dev-dex-values.yaml
 create mode 100644 docs/user/manifests/kubeapps-local-dev-tiller-rbac.yaml
 create mode 100644 docs/user/manifests/kubeapps-local-dev-users-rbac.yaml
 create mode 100644 script/deploy-dev.mk

diff --git a/Makefile b/Makefile
index b48a07cf864..e332d5eb82e 100644
--- a/Makefile
+++ b/Makefile
@@ -6,6 +6,7 @@ VERSION ?= $$(git rev-parse HEAD)
 
 include ./script/cluster-kind.mk
 include ./script/cluster-openshift.mk
+include ./script/deploy-dev.mk
 
 IMG_MODIFIER ?= 
 
diff --git a/docs/user/manifests/kubeapps-local-dev-apiserver-config.json b/docs/user/manifests/kubeapps-local-dev-apiserver-config.json
index faab2b952c6..97d3aca3bf9 100644
--- a/docs/user/manifests/kubeapps-local-dev-apiserver-config.json
+++ b/docs/user/manifests/kubeapps-local-dev-apiserver-config.json
@@ -7,8 +7,8 @@
       "extraMounts": [
         {
           "readOnly": true,
-          "hostPath": "./script/test-certs/ca.cert.pem",
-          "containerPath": "/etc/ssl/certs/kubeapps-local-ca.cert.pem"
+          "hostPath": "./script/test-certs/dex.cert.pem",
+          "containerPath": "/etc/ssl/certs/dex.cert.pem"
         }
       ]
     }
@@ -18,7 +18,7 @@
       "group": "kubeadm.k8s.io",
       "version": "v1beta2",
       "kind": "ClusterConfiguration",
-      "patch": "[{ \"op\": \"add\", \"path\": \"/apiServer/extraArgs\", \"value\": {}}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-issuer-url\", \"value\": \"https://dex.dex:32000\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-client-id\", \"value\": \"kubeapps\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-ca-file\", \"value\": \"/etc/ssl/certs/kubeapps-local-ca.cert.pem\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-username-claim\", \"value\": \"email\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-username-prefix\",\"value\": \"oidc:\"}]"
+      "patch": "[{ \"op\": \"add\", \"path\": \"/apiServer/extraArgs\", \"value\": {}}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-issuer-url\", \"value\": \"https://dex.dex:32000\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-client-id\", \"value\": \"kubeapps\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-ca-file\", \"value\": \"/etc/ssl/certs/dex.cert.pem\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-username-claim\", \"value\": \"email\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-username-prefix\",\"value\": \"oidc:\"}]"
     }
   ]
 }
diff --git a/docs/user/manifests/kubeapps-local-dev-auth-proxy-values.yaml b/docs/user/manifests/kubeapps-local-dev-auth-proxy-values.yaml
new file mode 100644
index 00000000000..9d9d38e284e
--- /dev/null
+++ b/docs/user/manifests/kubeapps-local-dev-auth-proxy-values.yaml
@@ -0,0 +1,10 @@
+authProxy:
+  enabled: true
+  provider: oidc
+  clientID: kubeapps
+  clientSecret: ZXhhbXBsZS1hcHAtc2VjcmV0
+  cookieSecret: bm90LWdvb2Qtc2VjcmV0Cg==
+  additionalFlags:
+    - -cookie-secure=false
+    - -oidc-issuer-url=https://dex.dex:32000
+    - -ssl-insecure-skip-verify=true
diff --git a/docs/user/manifests/kubeapps-local-dev-dex-values.yaml b/docs/user/manifests/kubeapps-local-dev-dex-values.yaml
new file mode 100644
index 00000000000..54c373cb57a
--- /dev/null
+++ b/docs/user/manifests/kubeapps-local-dev-dex-values.yaml
@@ -0,0 +1,27 @@
+https: true
+certs:
+  web:
+    create: false
+config:
+  issuer: https://dex.dex:32000
+  web:
+    tlsCert: /etc/dex/tls/https/server/tls.crt
+    tlsKey: /etc/dex/tls/https/server/tls.key
+  # Instead of reading from an external storage, use this list of clients.
+  staticClients:
+  - id: kubeapps
+    redirectURIs:
+    - 'http://localhost:3000/oauth2/callback'
+    name: 'Kubeapps'
+    secret: ZXhhbXBsZS1hcHAtc2VjcmV0
+  staticPasswords:
+  # Both users have a bcrypt hash of the string "password"
+  - email: "kubeapps-operator@example.com"
+    hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
+    username: "admin"
+    userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
+  - email: "kubeapps-user@example.com"
+    hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
+    username: "kubeapps-user"
+    userID: "08a8684b-db88-4b73-90a9-3cd1661f5467"
+grpc: false
diff --git a/docs/user/manifests/kubeapps-local-dev-tiller-rbac.yaml b/docs/user/manifests/kubeapps-local-dev-tiller-rbac.yaml
new file mode 100644
index 00000000000..b3f5dd46153
--- /dev/null
+++ b/docs/user/manifests/kubeapps-local-dev-tiller-rbac.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tiller
+  namespace: kube-system
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: tiller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: tiller
+  namespace: kube-system
+
diff --git a/docs/user/manifests/kubeapps-local-dev-users-rbac.yaml b/docs/user/manifests/kubeapps-local-dev-users-rbac.yaml
new file mode 100644
index 00000000000..6b354bde40a
--- /dev/null
+++ b/docs/user/manifests/kubeapps-local-dev-users-rbac.yaml
@@ -0,0 +1,34 @@
+# kubeapps-operator has cluster-admin
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kubeapps-operator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: oidc:kubeapps-operator@example.com
+# kubeapps-user has access only to the kubeapps-user-namespace namespace
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: kubeapps-user-namespace
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kubeapps-user
+  namespace: kubeapps-user-namespace
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: oidc:kubeapps-user@example.com
+
diff --git a/script/cluster-kind.mk b/script/cluster-kind.mk
index 476d04d5d13..0c9a62961fd 100644
--- a/script/cluster-kind.mk
+++ b/script/cluster-kind.mk
@@ -19,6 +19,7 @@ ${CLUSTER_CONFIG}: devel/local-dev-apiserver-config.json
 cluster-kind: ${CLUSTER_CONFIG}
 
 delete-cluster-kind:
-	kind delete cluster --name ${CLUSTER_NAME}
+	kind delete cluster --name ${CLUSTER_NAME} || true
+	rm devel/local-dev-apiserver-config.json || true
 
 .PHONY: cluster-kind cluster-kind-delete
diff --git a/script/deploy-dev.mk b/script/deploy-dev.mk
new file mode 100644
index 00000000000..73b3dd28c3b
--- /dev/null
+++ b/script/deploy-dev.mk
@@ -0,0 +1,52 @@
+# Deploy a dev environment of Kubeapps using OIDC for authentication with a
+# local dex as the provider.
+#
+# Targets in this helper assume that kubectl is configured with a cluster
+# that has been setup with OIDC support (see ./cluster-kind.mk)
+
+deploy-helm:
+	kubectl apply -f ./docs/user/manifests/kubeapps-local-dev-tiller-rbac.yaml
+	helm init --service-account tiller --wait
+
+deploy-dex: deploy-helm
+	kubectl create namespace dex
+	kubectl -n dex create secret tls dex-web-server-tls \
+		--key ./script/test-certs/dex.key.pem \
+		--cert ./script/test-certs/dex.cert.pem
+	helm install stable/dex --namespace dex --name dex --version 2.4.0 \
+		--values ./docs/user/manifests/kubeapps-local-dev-dex-values.yaml
+
+# The api server does not have service dns entries (in kind or vanilla k8s), so
+# dex is normally required to be available on an external host. Short-circuit
+# that requirement by ensuring dex.dex resolves to the internal IP address on
+# the apiserver so that it can initialise the oidc plugin.
+update-apiserver-etc-hosts:
+	while ! kubectl -n kube-system get po kube-apiserver-kubeapps-control-plane; do \
+		echo "Waiting for api server" && sleep 1; \
+	done
+	kubectl -n kube-system exec kube-apiserver-kubeapps-control-plane -- \
+		sh -c "echo '$(shell kubectl -n dex get svc -o=jsonpath='{.items[0].spec.clusterIP}') dex.dex' >> /etc/hosts"
+
+deploy-dev: deploy-dex update-apiserver-etc-hosts
+	helm install ./chart/kubeapps --namespace kubeapps --name kubeapps \
+		--values ./docs/user/manifests/kubeapps-local-dev-values.yaml \
+		--values ./docs/user/manifests/kubeapps-local-dev-auth-proxy-values.yaml
+	kubectl apply -f ./docs/user/manifests/kubeapps-local-dev-users-rbac.yaml
+	@echo "\nEnsure you have the entry '127.0.0.1 dex.dex' in your /etc/hosts, then run\n"
+	@echo "kubectl -n dex port-forward svc/dex 32000\n"
+	@echo "and in another terminal using the same cluster,\n"
+	@echo "kubectl -n kubeapps port-forward svc/kubeapps 3000:80\n"
+	@echo "You can then open http://localhost:3000 and login as either of"
+	@echo "  kubeapps-operator@example.com:password"
+	@echo "  kubeapps-user@example.com:password"
+	@echo "to authenticate with the corresponding permissions."
+
+reset-dev:
+	helm delete --purge kubeapps || true
+	helm delete --purge dex || true
+	kubectl delete namespace dex kubeapps || true
+	helm reset || true
+	kubectl delete -f ./docs/user/manifests/kubeapps-local-dev-tiller-rbac.yaml || true
+	kubectl delete -f ./docs/user/manifests/kubeapps-local-dev-users-rbac.yaml
+
+.PHONY: deploy-dex deploy-dev reset-dev update-apiserver-etc-hosts
diff --git a/script/test-certs/ca.cert.pem b/script/test-certs/ca.cert.pem
index bf5fb226f50..b8d153064b3 100644
--- a/script/test-certs/ca.cert.pem
+++ b/script/test-certs/ca.cert.pem
@@ -1,30 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIFDTCCAvWgAwIBAgIUQLz2bm0fYy1ctWoRM2bwGoG1vBYwDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAwwLa3ViZWFwcHMtY2EwHhcNMTkxMTA1MDU0MjAwWhcNMzkx
-MDMxMDU0MjAwWjAWMRQwEgYDVQQDDAtrdWJlYXBwcy1jYTCCAiIwDQYJKoZIhvcN
-AQEBBQADggIPADCCAgoCggIBANhf6+66VFCDyDoPXecisT7adkSCb/sWb3eWbp7Z
-K2/VUM3kJlonrwPC+qMo7oBtWCT9tdk2QQZmLFGw+KD/2PO24sxQXYZcmjDED9IM
-2LpX+eHeE2370A20UbQb0go9D5nFVpk6rG+tYQkkYUvDB3FwCfQEEpsLFoHYjiER
-ZelyKfu882riot16DNPeWaLr5jsGL8wTHUJw7bLkA6SgmjdUzDKBmVp7glM+5UOY
-7htAb8UEq0+1eH2YXCZpxTCdEI53obuyl1Sua0F+vWADAf9zejFw7v7o8W3fCG4A
-6SUN4QByvsg5P8+OxmaOpzHz3g29GqAZLmOX96sN9+CLvoMRsmikyXHjcrJ4yrXr
-OdyLzWoukCgpiawyIHFDKBQ2spGiRiUPrj5GsBUpECRAenwMc/enx7QsljyIBGRc
-WcknONwi0opxemGlVrVy12x95BlgmcWUEbvxJlXCGo7ZQ/cKQ6rLoUMnh7Yi7LA+
-Gk0R+GWuk/oU5VgDz5mToeRLI+gvt/waf2FGfPasz6W66lWxaH7MR8ucLw3we6fE
-y1K0hX3t+nNOa1mJsMiXWzvmVsEgZdLKkY8cTgdfeqk/t37h3fTmQs+3CLoTUwOD
-+Z9b/Al1GAQHziFmtTn8B+Ej0PUImnCxo8dBjZTf5Iq0yN5RjT7XLhkmTyZ0IFyW
-YDkDAgMBAAGjUzBRMB0GA1UdDgQWBBTwC0pIDHG1nAh2lJgJkG21ooXibTAfBgNV
-HSMEGDAWgBTwC0pIDHG1nAh2lJgJkG21ooXibTAPBgNVHRMBAf8EBTADAQH/MA0G
-CSqGSIb3DQEBCwUAA4ICAQBC/C258X3hn38TzIK4EqyHDJwXhrPaKvPJvziD+zvT
-cEYfbFXJLKfd0t83YNzaQs1H49VV0Gu7FTbYuqN/MFMKnVJW/8QS2KXlKt6ovTm+
-YGcmK+xmEML2i2nw79x2d7dIL5AKOe7oIbBTScVtdHRaZ2Iv2gLbtP16WPX0uI4z
-e/7lvc3pv0wGTCE6b0RZ+4+4bFTPowfN+VYbwRwoUeZQhGIkW10jLPFPPiisHoRP
-QmWBF/dTvj8LJqHQwJjV0FE52zf/SEjZCzxFLxo4zVrTGQXWiHcA18AAzzAS0M6F
-kRs3BFNEgC255MqiGRhJi8klS82tJ0RKDgsJ2viI9JUVn84XAtbzJFebZHfj0B2X
-Csa9bDvdDmkc6LUkhGJWBLiCOGYzo1D5Vub1pPHLRWwRBg5wqKG1Vl+CtKA/MN3d
-D6pPe90/ybWd825I5xc6U9MCj9BhvO5+YJzJzpy3cghwdJkpZ1KjIvYz0qf/6Lta
-4Zmn9Jz4F4CaafFZlVXmhTOIXnRgTEbiy6j2A6V1ppEvPO6ITpYVfElMlPR9RhrX
-Xt3uXPbgpcVl5H1eU/6fn4LJFPAPErKxdqjIiJldMOMp+c4o8CVtO3dH0KjN0Y1x
-Jbp5ELrj63z6s3xSatZBu1ZMtVso9VmNDM2/sjucdXlt4Yye6VuhQWeVArl9tz7q
-WA==
+MIIE/zCCAuegAwIBAgIJAKOL4oBWQrNSMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNV
+BAMMC2t1YmVhcHBzLWNhMB4XDTE5MTExMzAwNDYzN1oXDTM5MTEwODAwNDYzN1ow
+FjEUMBIGA1UEAwwLa3ViZWFwcHMtY2EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
+ggIKAoICAQC1Hul/DCsWQO0RuDR4RutxUIdCf2OB86ikYc3TWJ2aQPir1jP/vEkx
+zjx1VPeC1XtfW/1bQKz2iCV3G9XjnM5oe1hOVind/XV5KpHGbaPkaJqBFAeXEpHq
+5c8NkufQNddNPO90tIqLWfRyxBGJMcGKeMM8lefnlWCBqvT//3BRjsZImrS8B8cC
+bx/PoyelvMBZH4g3FmRIBJR9nY6MzJbaEjmzQjESFUOrZJbFe9crqaIZ51LHvX2t
+U0meV6BmeJir+Ow1IlpycaMAHH41ZUfPu2UBw0w9mLHVTnWn6S0LzbmEwRAek9Jt
+IOsp10XxN4Sq54xuoBpfidn3fdGvKIba+IAdYEPHlgyyv9XBSIDe05HA0mFSjILk
+LPlAUo2tAhOKD5Oq48HbcOjCvt8uOthA/9/eDyZBZStNRSVBBwOtqFeeT6Y1ecX1
+vC08Ck2XhHvKVH+MB4F57YxyK/ReVPfDdlLML56LgH2sFhmOLBRt+rtwj9AD41w6
+dCYquNsfHXTpnYlA7vgnXCnQckkBNkc1JXAeVLQ/J5N83FuRB+I8NVkmM8FUMjgv
+HXgLYrn6o8QUQeTenYJTC2FnPrZbOzh9T68rWye+OhdYxD3g8vHwoUNEuywmZ/ch
+g5hfLqOjpOIu5rDX2RWLF94EW/oF3cq6+Ntoy6+Sm74wtqaLhoYihwIDAQABo1Aw
+TjAdBgNVHQ4EFgQUC9T3gVtFcjQPszRq3ZRJEwF6t0IwHwYDVR0jBBgwFoAUC9T3
+gVtFcjQPszRq3ZRJEwF6t0IwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
+AgEAVE7tZjE05qVM/54Rh9Y/SwAt3agZmkiNmOTVp3Nhw/OVxWW6s9VxX3CvZahe
+bN+qRKdigW6YigmLMf2mUvEEd6GjZuOWTQqvJjglA+WRGQuhZDE7VfAwIBuSf9xT
+fgHNLRY8q+RfDvVKdndyP8mxoQFN4I/YQmUhAnMw1aZwMb7YWyUNl95P86+EEs64
+eMTGgc45Gc/hTNoRmoS45bzWZTccHypxr0wkmZZEPvRt8uia55YyKUu+a88F1HIH
+pLx8o6D48pv1kF3V9HL9zFjDLekNREtHQxNYAitupUDz/hbf/Fv2DMKdKiTV8RhA
+QkPrLyyt53sBJoopxyZzFXTucFw/N2reymYOTInRDpfc9Jj8QAyGhVBF2cFFBEbU
+56TZ3bSsxFPvLpG51ccVJogGb4073nH9iZDbdOI9HGK7dZK1VlLJ0ftEqZyjwdij
+h7i0hKBBRjSAkH1bXD5ti6XwOkqR2/huC0kv7RsQno2d59NN4hdM36lk0LL/Gr7p
+922aWxR34qcRC71vx/vvuqrHfX/BPf8ZdXAPHHpmjLaHTNsk0oLeoHEXNovozUX3
+qIutu5NeYwcOYabXVU1RRoXrVZesweBJzE6RFAM3BjRh55xyVQ7/6QYJ9ikl+6eb
+nER96EAilscq0RRl7QktQzkeNtIAuCAbyN+OF203SGDqiiQ=
 -----END CERTIFICATE-----
diff --git a/script/test-certs/dex.cert.pem b/script/test-certs/dex.cert.pem
index ab76b94dc69..d584a55777f 100644
--- a/script/test-certs/dex.cert.pem
+++ b/script/test-certs/dex.cert.pem
@@ -1,28 +1,27 @@
 -----BEGIN CERTIFICATE-----
-MIIEszCCApsCFBCLdNSO4+LHZUmF5XkvJcjmniYCMA0GCSqGSIb3DQEBCwUAMBYx
-FDASBgNVBAMMC2t1YmVhcHBzLWNhMB4XDTE5MTEwNTA1NDIwM1oXDTM5MTAzMTA1
-NDIwM1owFjEUMBIGA1UEAwwLa3ViZWFwcHMtY2EwggIiMA0GCSqGSIb3DQEBAQUA
-A4ICDwAwggIKAoICAQCYl5Ad2EvX3Gg9AK0yBUIxz3XfNzPP4DifnbHVuYDM80U/
-o2W4DT1p+QNbWWr8Cbu+Rab2eqob/hPovmd3olHE50l7ADlVx6idKgx481qAKukP
-kVV9vo6FGZVD1HLe+5JAhLDgOkbi9OBR0cqnQszyCSfjVCoaQ7vbYjXBv/RLFP6/
-b8/I/387hWIZawMWC7IOxm7rY3L0vZMIEdvh5Q6GKtNdZcfQ42CyQkeuDDTidaQb
-VZfKCsf1qrbDX9EvlfDNIhhMRXgCiJFJ5WctP+Ns06k8MJ2Ng7KcngTSjF7YEDph
-qtfV4Km7MxAtYlDuscPIig0X6JLBX77N8F9asYCFQlozcEPSnHa1/ywkPJrp1yqS
-jlDaaYzVoSj4hzimwFBYqtb4GV0vk0HIHbLkjVMdujLqjGNOw+TMv+LNbNBZjWAT
-p/Iwz84+1sYSd5TC0OodrTpUcuvCLn9EFG+gINn/adgwEMXZEEnHVDMszn9tYGuY
-1hpDrsHhxY2HVN3hR9Y8ubf/Ew0ACRYHlfb04+j8W+H2kMCQj0vCnuPCjqePU13g
-vK0HqLZ5/1zFw1cosm8KmMh0MfYqMgl8AQK1iVE5e4Az9Sgx1besELByJbhO/dNj
-cOYSbN5CE/hzWT/CuyhBUgMhxbaIV0TP9Cq2JmRgn36JymgWiWsLsoNnayidMwID
-AQABMA0GCSqGSIb3DQEBCwUAA4ICAQClAfWvNGFgsmsxMdm6xkg5DUOM2t0idw18
-TJcZRrSNvKv3o2b4gz47hW0lwCaxchq5UJbMf+jl/jsJCz9ClEOBNI2w9/YR0QGN
-Ha97pjB/+wXqyVZCJ6FrUiQ7hpnOkFt6CzOsLXNhGbPnqNFay++8W7gjUXXzK8jj
-MFfJVErGoPvloYpiqwx/XlSrbkWYn6PsjYt5tqYzTGbYgc/Dq8ceN1rC9G8hRGVr
-uQvWfS0C6ykVy0CttNyvT2GZ0Em4tdhnbWfaRkBWfYmPMx0YPJAi8a6Z/AUNldf7
-+iNHj+FvAdlrcCalc2QEQuFVuoiz7jg0XgCgQmCEEIYwNBjQaN0oe33SYbyzkfNq
-xb5RGEP40+Y7TBNShDc8PHa3PbkCTa9TXZr+GlHAoMNPcbrw1HgIUYb4Hkwi9Nuw
-RDD/7nA/MzpK7cGmtlYaOuVUMCed7Vj3OBG5QveU6XRpeJR8Erv1vkCp4iZf6Q8W
-jufnd2bnB3YqOLTIf8KeRgKXToAQocu0YK5ZLLgnMzYp/Bz9nXoK8kc083377q4Y
-chKQYysByxH0Ju0uPn04MKkzCxtneSCZX3y8zKn7siE/UTmazE/H/Kf6QYb9MYmQ
-ehGbF0tjzAMUjMh7tMlsFqA5kT1iAw5CWELHldaInl86BozQD9Hw1mBp9MUkZfgY
-BEniXEI64Q==
+MIIEpDCCAowCCQDQ1XUVemTFBjANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtr
+dWJlYXBwcy1jYTAeFw0xOTExMTMwMDQ2MzlaFw0zOTExMDgwMDQ2MzlaMBIxEDAO
+BgNVBAMMB2RleC5kZXgwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCr
+Lvi4QuqIgFMWmMVjk+8XX0ECJo8NpOKVIQCDAY9KdHT+BM9/tfbfZMJwOiMn8qz2
+XLyI4nzohyLyx++B+nfmoVQW1pu35ayppscQbI0C2jyhakAOp2a+uzvEUcCUmgzs
+VM18EvnIElHWIg+XcUxY2DXI7uI27ECVGcch1znLuWQnqxj/ukskBAVLus4coPWT
+rs2jGikZ4f5c+lI7ijM86pCUK3gsHDMqMoUEpab/+3WmI0M3WahLS7rVtNkJiuQl
+flRiMW0F8rr3noyIf72B1z/SaDOJV0+DM9ExKLAyhSYK31XlyWTuRMYH9u7gZ1nN
+wKBHHFS23S52oq8PBdJEVELoMpKBa3BW7hiUNGgC89kdyOn+Hv+Emh0zNYHGeK0P
++olyQQmtL+alaQmEph+YNp4TVXmTkSInSFo5JeOL3ZXWX4eAMcAJcGsGMpSQ2qPc
+itn6l+ObYZjHYtZeXV09SNDjs2WBfjLMsL5pCny2TJU5bvuLbGUU2w1K8xUNDQIY
+e+3uA3Mb+GXGU1lJrjUT9sgndGT6h9NNCLd/HQTQTqCJ1xZJWC/KqxYbGbylP1QF
+SxKkev8I5TfAaVHBLBR2xzx+RCXQW1roONIrtFqqL2yQQoW5dRHFf49D3T10eO8p
+WW+7g0rkmr0OVYtssQ0fIejy9HBqZ39W2P3U3+UQuwIDAQABMA0GCSqGSIb3DQEB
+CwUAA4ICAQBprzbKfHHSlAQmJWDLz6NgjQ6/TE6FGjvibIpAg2s7oG80v4qVbqSR
+e6pF6BQAG5zSW+PTBag89INVbpGUNoXkUdHhHdZMNOrVgmiosdmzA7rTBYfnv4Be
+m/FaJogdRedCOtRUcQoBHMCVE38ScltdwRcGqdQfc8k6ITKA+5GTAt+CPMxzZyKE
+k40lbiF/F73pEBBk945JAucMIq+w+11PDF194vC4SurJI4qs1IBByjGpK+T3b0rK
+H8av/n+uFMT0HToWYU/ynHqVdngE65LHsuHmz9NmTG39W2i+IpsblPsO0QlaAvgN
+KLmgeemmxjFl2Ju3OXKq747DFzyuGSGbrGox04dwiysSNcV4JmB2uAhRzyu0+qFm
+z2CuVT815cvLPT3gwYnoGReP4YZuUdaCIr1T7FZ7f3A0gjUA/uzsRGWlgDLtzq6r
+1AnssRIoXnyHIrB+fzFLbo/UZGUc26q3d+lshwLvFDN0MHaAFPJFhvfUcVzmTwkt
+E7JUG5drdhw2xKXKQQennVJY2/X9LPFXSYwXNpgdYWXC15sPBUCrX14gjqUE35wQ
+Ds5Nk7ApS8qdFgr4/YsUuO4W47Aqf7fZNGrOxK6AsvPlnlS6k6W0Gco2gqa3i9su
+B4ss7jmPIf/u4ED0Tbyc/nci+uatdN1HoI5tFqme/32hh8wd/EZj9Q==
 -----END CERTIFICATE-----
diff --git a/script/test-certs/dex.key.pem b/script/test-certs/dex.key.pem
index d4eb0f1d928..a0dd8e2ec7a 100644
--- a/script/test-certs/dex.key.pem
+++ b/script/test-certs/dex.key.pem
@@ -1,51 +1,51 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIJKAIBAAKCAgEAmJeQHdhL19xoPQCtMgVCMc913zczz+A4n52x1bmAzPNFP6Nl
-uA09afkDW1lq/Am7vkWm9nqqG/4T6L5nd6JRxOdJewA5VceonSoMePNagCrpD5FV
-fb6OhRmVQ9Ry3vuSQISw4DpG4vTgUdHKp0LM8gkn41QqGkO722I1wb/0SxT+v2/P
-yP9/O4ViGWsDFguyDsZu62Ny9L2TCBHb4eUOhirTXWXH0ONgskJHrgw04nWkG1WX
-ygrH9aq2w1/RL5XwzSIYTEV4AoiRSeVnLT/jbNOpPDCdjYOynJ4E0oxe2BA6YarX
-1eCpuzMQLWJQ7rHDyIoNF+iSwV++zfBfWrGAhUJaM3BD0px2tf8sJDya6dcqko5Q
-2mmM1aEo+Ic4psBQWKrW+BldL5NByB2y5I1THboy6oxjTsPkzL/izWzQWY1gE6fy
-MM/OPtbGEneUwtDqHa06VHLrwi5/RBRvoCDZ/2nYMBDF2RBJx1QzLM5/bWBrmNYa
-Q67B4cWNh1Td4UfWPLm3/xMNAAkWB5X29OPo/Fvh9pDAkI9Lwp7jwo6nj1Nd4Lyt
-B6i2ef9cxcNXKLJvCpjIdDH2KjIJfAECtYlROXuAM/UoMdW3rBCwciW4Tv3TY3Dm
-EmzeQhP4c1k/wrsoQVIDIcW2iFdEz/QqtiZkYJ9+icpoFolrC7KDZ2sonTMCAwEA
-AQKCAgBj8QDnSz+Bhk6Phd3qIR+V2Ddvl4xL3qO3h2Vugi0mDz+PyslYnvNWcU4N
-iqdTpFxe5ufQD89Svjrz+aFy7dF4kbPC6AaldDuvlFbO8TSZNYGoPJwt250k9/iX
-kJIcEdFciIwAkKrVA2XYsPt2SX5KGE0Ty5A3250yt0RWPg8XDg07/VOuZglDRr1V
-wI0o50gb/UOw0FX+jhu68Vd+wLOelHYTehJBcmtm1Zp1GHGa0UpGzOy53A3TjZhe
-pmcwL5ikAmy/p9BOeHwQVjwZmvqt0IPLdFv80AEwKx8ld+K2yQoz5d2vq5H/lhZG
-Y1p2u99rfV/OBPn5xWgHIiSSFigCHN+EtjIsefGx8QFd/EO5AxOchpPSTrToim5P
-1MtSaTw04itgzXgz9e74qBDQfmwcg4FTJaSI3Dgkqsk8ilCCP7+1O8i4E9slP7yg
-4gWIVPaNIHvcszuQcZmVI7QiuiE/ftV2rAF7oPWc54hNpVcfngTlW61pLDZEo0s/
-kHvhR47Izz3ZUAbvzbNxXGoS8nUXGsfr9JWj5veLsQqqirDc6oJlvU3C1nE6UI79
-brykAl06ovJ8UtUGHkwLTFqicsguocIhmj6Bs3JZzqMXTslPlglSqxCVCjCsyp/t
-c3TPaWvKjjCi4NwkMZS7We8LbY8PwCo1MpKG4aE2isvN+NFJoQKCAQEAyOKL5+M8
-M7RiUi1QjvFwL4HyMo+tbDW5GlgGD4y6j15m6KcFPeKNnEZVa03Nag/sYhcrOY9s
-KpPewY8r/KFzu02JmOIHV/tEeNWjTfkfwSgdZnhc20iNczFQjkXNuDYnHOSTUhDy
-YCDUoaRX3rNRYzaLfc7y5w6c6OzFVtIR15aa0KSNaiC9x2ROg7IC1GUNXkfmh4eK
-buf2MpEL0pX4BjnvUKDVDCXXJSKEZNSLy3t6Gezld37daNKmVZzfTJd4ahZ54rDX
-GGVUv1L+oEkv5SI+jQ6blm3m0yUlCpfOIWMoljPX51W3oOUiA8Pj7I87CLYhDg12
-GEe5H3QkpXGMtQKCAQEAwnUXpXDRTywhIeT/KIjhUSD7nm4szrrn86F73DTQUuyo
-1w9R0tAyL6WZKJ31xICa0HmzZtItKyqch/0uGLhsxesA/A/gZLI3imtuw9jiq8J3
-Oo+x/E8LJLyIKfOtiZv8j7gbLHGhCZzs5MSSlUI9Nr7A29gb+hBZugNu+YRMCtX4
-tfXV0gyh8JBmyt8PVDJoa0YxK026Z1E/GJL1+BghQ9cySeN/kfj0VZRras6+yKWS
-pDvGCvjtrPrBY7LZ/36/4zL7Ggco0iXRbnC3JGI5msAGr5POwTh3t75ua9esqUHd
-P56dnlqtj+NoSYOJLMS53ABqSCDvGDnFJ8PAazWbRwKCAQAIO7C8OkX3YIc/Evhg
-Q2jzqYHBrL3Q14rUl5L4BC6JPbc+BcpjNOvU4dUSZsfqduibRJPS8hveytywVivZ
-WMyjepQPHgRrCLNPuIHO6kzw37IExx4XJqwVcon4qse5qw6DUqLvFB667d2JGnE3
-gWXuiQfCij7OVXz81udnnYh5q4SA1J2vIdRlXakSILOY/ONFX/EE0PtNfFhMzkEL
-ynW1254BUfYpX0uoC/gdIdDw8AibE2h8M0jjyO5kR9+nBfY7ctxf/Bt0toJ4rPAe
-paE+5N5nbZfW3H4/XSBdhMc/+w5oyYspwguanol8WgT3Zw9mVgCY0NhsOlROA7aU
-yUiZAoIBAHHClqbOrWSn6Gov0aYhDc+sgAdbZRM7/N5mplNZAlbA5LWL3M57xiBh
-vIwqfNEMe4Vi7TVF1+7c6t4Tm5gSrG/M37KWhyvhpuRvnUkt5M2e4ql7zyBQDbDc
-KryANhG/E63wgtUpVJCPIXdkGG0BZ1ZTmfgDIbrVPei4gX+vidz8+JdazlAn28Uk
-dT5R6GHVa4j2c2Vl/5rZyRPTRdpyI2PQzTa0xLjc7/Pw9DZz5OD1HCjAX0ekAUel
-GuX8h9QUjqWX+ZZsgdEPFsqJXlsGq7SAimjFC7u2ETOJUIf+kKAkTA8f+A3f9pGq
-9COts95g6GpwQ70Wp0mA4no05qjRn5kCggEBAJ9rbgWVaBAVH+wYDcKCceyVeKMQ
-lqi2SQHIg123MAuvi6Qs7zohneVPW3jOs3c9F0dQF44Ie2Qt9wD1cG/LlwID+/EX
-Co5Vk2Wg2UH+EVTIGViEWetTPPipgQm5REf4QUd/pjlz2/zJIYb9w6VdaZknx6ik
-X066IvIFz1eZ4EhZsGrZsw2asTeY9vxWGO+U7cLvNVphgOuw3+6REHuG7+cf9LVN
-3dOuG/D2gOPFlFnZmV/kik8mhjxDToOFQiJ7WuYD0cCUC4qR2KADhbAwbbAZx45Q
-yk5OynQhHAlqsUAD0qNKaWI1ANpUAw5GRDb+gDsXR2LrPzm5LiUHQFVfGzk=
+MIIJKQIBAAKCAgEAqy74uELqiIBTFpjFY5PvF19BAiaPDaTilSEAgwGPSnR0/gTP
+f7X232TCcDojJ/Ks9ly8iOJ86Ici8sfvgfp35qFUFtabt+WsqabHEGyNAto8oWpA
+Dqdmvrs7xFHAlJoM7FTNfBL5yBJR1iIPl3FMWNg1yO7iNuxAlRnHIdc5y7lkJ6sY
+/7pLJAQFS7rOHKD1k67NoxopGeH+XPpSO4ozPOqQlCt4LBwzKjKFBKWm//t1piND
+N1moS0u61bTZCYrkJX5UYjFtBfK6956MiH+9gdc/0mgziVdPgzPRMSiwMoUmCt9V
+5clk7kTGB/bu4GdZzcCgRxxUtt0udqKvDwXSRFRC6DKSgWtwVu4YlDRoAvPZHcjp
+/h7/hJodMzWBxnitD/qJckEJrS/mpWkJhKYfmDaeE1V5k5EiJ0haOSXji92V1l+H
+gDHACXBrBjKUkNqj3IrZ+pfjm2GYx2LWXl1dPUjQ47NlgX4yzLC+aQp8tkyVOW77
+i2xlFNsNSvMVDQ0CGHvt7gNzG/hlxlNZSa41E/bIJ3Rk+ofTTQi3fx0E0E6gidcW
+SVgvyqsWGxm8pT9UBUsSpHr/COU3wGlRwSwUdsc8fkQl0Fta6DjSK7Raqi9skEKF
+uXURxX+PQ909dHjvKVlvu4NK5Jq9DlWLbLENHyHo8vRwamd/Vtj91N/lELsCAwEA
+AQKCAgBRSoMObaiWnenXJ0FFYnD99lwWu1zfq9d13jAyBkGXp+oO3xXyneTYfS7g
+wJsFU3bTn4Jgtr1+Zv4vsMaKQPlDaoVWOx/Dmqv9/Jc3s3TbT+vO83fr/Y8LMDrX
+pcMATo+ogzT5oMFBQ4HdYFtrHYCWCEayXs7KKjMZGx63cU+e8TEgrV23wy3/snEZ
+X2KVsdItCavZsoimI+35FV6Lq7tdSD7UPjhZKiMZ/NeyN0Aw+6cI+GHpHQiQiSv2
+ZGVU5MInE/DamIIfev9Sq9Ys1AyYZjGGp7khlXbK5YaIA7x4oUZJj3lpH9RwWfR4
+v8j8g9ffn4P9gPSxyiNQbz0WszsANO9z4Yu8l5IfJPIhWZLewwPYY/zWjsVw3W/R
+IBc2JtvT5cJwaune7SkMsR9E4uxpTm4G2xAtnI+W0mZ2QHY84vTv7lPVOnw57i1O
+6Y2WMJlFSMnRWM8wTCmU1917Nq8Qy8ySD6kZtlF/feqskTmKc3COH8YwkkZ1+0X1
+VMEzcXSMtuUFBKp9AsoEfeWSgbTXx84Fp6EymqRyBACsnuOUMAxg1lZESiFoNsOj
+yZ5U1t/yR1+/1v2/db/Bk6bVE4hYPjpU/gz3kHkG/2QgLiY/oEUt459hwA017hSI
+usiwn7RvG+6tA/CriR3qs2QAUWeOxA5RufPu087lrJ84F+Je8QKCAQEA1Va5Sboh
+auqi7NW30Hk3BhlXXOFYn1+wsBbBwin26DGnJo6FxfaLTOpyPazWGLxAW+fhF4UW
+49ONQEn4ED1hnx/Au/kvdoc5tVKoTLP3LlFMbxWeTfOK3UL7QHuron0vK+i9xu0X
+o3zzqtJRQsdyNTiSejamksGCuRRj0ecj0qva8Dn9aA4s7W4SDxlXShJIEmk2SDlN
+MfZfWWloci3UwumGb4GZwZDqv50/twdPd1hdFyPViPvXPFNN7H8IsJz1WdOxV948
+fSLwFffs+rOKQ2Obd3Tz9DX2hmVqGBvyvmtwDxWIt1la6s6LNsE3lQx49TEPLRDc
+0RXtH50c9lQvnwKCAQEAzWo6HwXUPJ0CRZb5cilT7umEYzSqeFYctE5IIBzY16aj
+M3HdpZ2a4MwdG05JbI6PH8N+rsDwdKvnDpWJue23qq4PsIWEfBo5k2NHBgC3Kz/X
+mw8MdieYZO4x24+yFkbdNliLjvez+PzFbzF7GRNjE92vGMuJlyq3gy8a7dzzwFmU
+IkjbyDp1fVAN1CIRW8zockQD/uwbZX/oK32pK6cIzwNKhJ/3ZTg3GCOJGhMSQTko
+xqmal0lWxzf+LmEqzMpwWJwvP+9q9UMceUuZPQvoYLwHOoeWq8GE8qlPMG581toB
+LhL9MWbbYvXNORcBQm8aMWocAeTFHPQWAcoZn+BZZQKCAQEAo6rCv4MiPAoCMDvN
+pww3YGB0m3buLGaXAKCUyUa0e3IMUBIrIrKAL+P0/MfqAFP79AYys36RDvuvc9DL
+lHniuNb9X7hN51ratPbS0vWF/my0fMxTBG6A7DqE0vWNuTzcwYzuevxNlEk6DqUH
+XnnwblAWX9gpdpEqnp677b6rxuW9M2rps7icUxKMnDTOuK7JyAYbdNExHdFrWQb6
+8A2lGltZnZYJxWxOC+6xgNME7gRGdogxO8QpXchzEaprmkLwH5e+iDCgq0fwdIod
+rj+rJQP3s29v8LytgnGvMQvP8LIv6AKXPkI488a9Gqak454L9d9LS0GShn2Ryx0X
+qQrw9QKCAQEAvf53/cO9d8bdmBI5bN9O89bnjX7kAePcLuWNDq6/3k8R+n5iPVIW
+M8B3V49EmHUPapi+rtJkVfW+BB5KQj/etq7Ccko8rTDweiPESIgW45jsSk5T/2FG
+MmyijutNFA+9ggvKIZV40F60GtHQgvQMmw5bavqvq7NmA59pMANDLXFtc3yiVIPF
+sf9+muxb0+YmRbIlY/9so6f3zWowM+EOY7MulJcFE4k4ZEpSAF0NcGh3D7FF/JJo
+AmIG500Wck74NO1ZQrCm5G2Lg6Fp/i3qZLbllLxen0SiPHRfe3NmYq9Hkh8cMzpo
+xxKFHD3r+0+aEYSMnS/FJa+aP1N3+glfhQKCAQAh++qI7huq7C70ISx08QKdB2cG
+H8qUBE9ZG2p5Wo4U2iAVwFYS6z95GI053SQOulxuNg/bRDjGJ0GnpEJu8EFrg1qt
+P0AOtNSvc+QRe2UjAr1PwZdN6grkGvjm4pk8igtPpDk32dgjHncww6YiXW/Q0NWr
+Ked7h0piu6gRIBN+Z9Cx4MTZgBU/n0CTixyX+/krasv/H6ZJJQ7QN7AAJjMp2cQr
+HNg1FNDa+Eq4NDPNDLdwEvVtriCQ8/m6BPR0O/kYAKAfXI1iCEmJm5gPS0uLzMV2
+XlEW7AzLD+Maid/9gEDoa+yuOsNl8caHVGYNKWKTxca2h4Ptj+Gzxc3FoStI
 -----END RSA PRIVATE KEY-----
diff --git a/script/test-certs/gen-certs.sh b/script/test-certs/gen-certs.sh
index 61483de6ec9..73f56bd6a6c 100755
--- a/script/test-certs/gen-certs.sh
+++ b/script/test-certs/gen-certs.sh
@@ -4,7 +4,6 @@ cat << EOF > tls_config
 [req]
 req_extensions = v3_req
 distinguished_name = req_distinguished_name
-prompt = "no"
 
 [req_distinguished_name]
 
@@ -29,7 +28,7 @@ openssl genrsa -out ./helm.key.pem 4096
 openssl genrsa -out ./dex.key.pem 4096
 
 openssl req -key tiller.key.pem -new -sha256 -out tiller.csr.pem -config tls_config -subj "/CN=kubeapps-ca"
-openssl req -key dex.key.pem    -new -sha256 -out dex.csr.pem    -config tls_config -subj "/CN=kubeapps-ca"
+openssl req -key dex.key.pem    -new -sha256 -out dex.csr.pem    -config tls_config -subj "/CN=dex.dex"
 openssl req -key helm.key.pem   -new -sha256 -out helm.csr.pem   -config tls_config -subj "/CN=kubeapps-ca"
 
 openssl x509 -days 7300 -req -CA ca.cert.pem -CAkey ca.key.pem -CAcreateserial -in tiller.csr.pem -out tiller.cert.pem
@@ -37,4 +36,4 @@ openssl x509 -days 7300 -req -CA ca.cert.pem -CAkey ca.key.pem -CAcreateserial -
 openssl x509 -days 7300 -req -CA ca.cert.pem -CAkey ca.key.pem -CAcreateserial -in dex.csr.pem -out dex.cert.pem
 
 # clean up unnecessary files
-rm ca.key.pem ca.cert.srl dex.csr.pem helm.csr.pem tiller.csr.pem tls_config
\ No newline at end of file
+rm ca.key.pem ca.srl dex.csr.pem helm.csr.pem tiller.csr.pem tls_config
diff --git a/script/test-certs/helm.cert.pem b/script/test-certs/helm.cert.pem
index 1d3e2fa56f1..27cbcd0b478 100644
--- a/script/test-certs/helm.cert.pem
+++ b/script/test-certs/helm.cert.pem
@@ -1,28 +1,27 @@
 -----BEGIN CERTIFICATE-----
-MIIEszCCApsCFBCLdNSO4+LHZUmF5XkvJcjmniYBMA0GCSqGSIb3DQEBCwUAMBYx
-FDASBgNVBAMMC2t1YmVhcHBzLWNhMB4XDTE5MTEwNTA1NDIwM1oXDTM5MTAzMTA1
-NDIwM1owFjEUMBIGA1UEAwwLa3ViZWFwcHMtY2EwggIiMA0GCSqGSIb3DQEBAQUA
-A4ICDwAwggIKAoICAQDQBfiKOk5kZxyq+hNByb8jCEq8uAlEAP6hSBLK6JPCec0c
-X4wT/ZiY1UcOtrPuYy7igmNu+acOsK5LtNe6kikQJ6EKe0hFW+RwNgqnUOzXWX7E
-xkoKCBiKAC6R5nicJk+XW4T8XTLS9TdxEezF/o6n7KsMg/pHpo+Pcf8rliU53nxU
-9f23DKXpxhdjoD7+49lMoybUxNV7mUqLiZSPU/9E0C1Hx3OOKZhgdHbghVlubLCJ
-eTnNQlIvNThNBu2xK1KSf5StsR/tdc4UGxRLYuhwiJTOkFAIz+MXe1UbB9SgXCqz
-Xk6qprh8JIJyL8cAFj8d2480aG57haUIsYoPBcXfCsjpX0zSl/kJ5fSJylu9er/T
-/Uyjz4UBno5ULdQeigZcKYiI0QlKnuQRJk1P363nOtHc2jKogEW6UgUTKK811ZrQ
-9uUkx0bZOa/nOeLFN+LXZCcR6ke14L3g6uYbRTOmvVFcB6Tr8zS5r6kd2NXcsKjX
-CP2pEyTeb/sAK1XP17O0Ao5GubogTNVKBtt4R41NXe9Aimcon+focfbEALSNioWe
-vL1WYQyOEUGybMfWNetWzBWa1nJLdQQ8M+i+5/wmKYHPWxVeWAKID9MbU7MlReXq
-Ro5iB8qIkYv3qxZv32vEHX8T9Eu4frgHhjfz2XzVyqHaXFDasr8yyL4gVuT7+wID
-AQABMA0GCSqGSIb3DQEBCwUAA4ICAQCXzv/jLWrMGDhvE2lzx0CoqtL25XnVzQwc
-GA0KxCChzw9YZPgx2uI2bL7NFJX3o/jWcyEOWqn6U+Jd24m2Xjcr3cx1Ux/BEzix
-NoHdHDnX5eR/Tngpuy3dqkcO05QQD0dB5y3Yah38BuBveRQpDgLpXchhLoVr/hrl
-9DjE54Axa8bADwSU47xClsnOkaimxkRqErvcvJ4AnNwZHlZgqpP3VS/M65PHaxCJ
-bAa9xlXbJPaFEiClqiDsej7CNQFIrt9gXcxkSFa1bm9uJXGsOewWfpdmEceFCqQA
-J2ya9RDURho4KxBcaH0/Lj8DncKM8nEqk1/3UFeXB74E6mpNBjW+FqYq9ry0qDtL
-TRRuopcnCe7MeD4KQPxW3OBp8W+IK7wYA2Zk1JQeLwrW15qnhGzvxToeq2g4BpuL
-HLLB2KnOLzb18T4m73NFDipGuRT7BQljRq0+0h050eDyEGcmIIsxP7jhTVKdFOsF
-l4hpDH+By30dD2M9Vwh9Af0s1UrJHS4Xwh3aONt4kaogGPGNSWcwS3KWytX9di4g
-wJnSZXlJU1yxidg6kAe+4pr43I6dZvPLR8S3YCQmfhItB3bRqQY1yEYrt1VQ3xtg
-I9Zcs0o+9TwCOYDnTxXwdGsXz5IxhUFejM6p5b/b5CXkrYfbfFnVYT1MOixeGtBA
-5az/v0iSZQ==
+MIIEqDCCApACCQDQ1XUVemTFBTANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtr
+dWJlYXBwcy1jYTAeFw0xOTExMTMwMDQ2MzlaFw0zOTExMDgwMDQ2MzlaMBYxFDAS
+BgNVBAMMC2t1YmVhcHBzLWNhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
+AgEA9Q+erh8wIgiZMetmDqfNNUenHEXgGX7claArHwcZg+P8EEbazPZnOewBIcxe
+sOwiHVW0o5RWKqJhlso5qgp7UkqieKYHJcoBYmX+Pcbk2KngDxLArgnD9LLgyJO9
+LBLW/HB1xbqCJsFpdq9TIyBCMpCnz+EF09azFZQqulMHxhBqX9TJtfXXq56Bal/3
+YLC0gmDoyqKzMkKxTp+YhB0mVCagnkNvWWvoZKnVAO7ZEoZCHgiuYw7eBSbbWXxq
+W4tlyHgAOP3f1dIlwxBXNcq/2GWxYE/nqlGk8hOgpCKMf0PeXptPZOZCHQOJBaYK
+gkVR/05HYqPPt5WkjTn9vuPekG/UFora3wblzNieiao70yjUU8RABps0Eiahjcan
+2WOWv4NjSKimRZjkJn5WpZumKdKy5RlFAJ/4LNiJKAPJJi8zBER9+ml2BiUJmmSj
+ujKgbLgX8kA68sdl6VyvZYLRYFpyikOJw+hLW4iD7FalMYo4riOakf40W9pnfuC+
+Qp9zZs3bpwDAjC0++xTdiKl2Is3iDTGDTFJLisgk7w0Mjb2iQvyF0CLPP2cnjaBP
+80rZVkxXXLmPIa2D16wNvT9AwPYqxR/DA0b5WsvKr1gYwg1sKmdQq9l7rjxomeHG
+puuYw9JnC12mKaPJGPG5MOREcUrQULHMLn1Oelq2KC6qrWMCAwEAATANBgkqhkiG
+9w0BAQsFAAOCAgEAUqFfnq6iULx/xWT1fd1kFp4VOHVv8NnXpxtkWurUMHDccj+k
+5MAY3hPhKwkxdFCrqlTP1FXwkteiMn2k+UHjSHOXQut1TnrExHqal/zXqVG5prqv
+s4HSbNnAymnVv7x+ip7hrXG31hjUp1F/teFEm/04RWMfVlVxWyFCcfR5XCXaCLn8
+rgPWHZAzyUxredoAgBdcz36y7IOGcs9zG656VLOATZTqtBvDOTWl8qf2L+OMAjqI
+ufsEKYcFDKe6aJgUir5ysez8mpxADxO094N888I7vCQGq0+newDI6m0Is3Z67deZ
+BgCElNJmSiMaPd4RcYtMdN+Vazq6VLMSePpArohBXPdfD7/0Zds1wOaWlpIp6L/n
+J/NxQD8NEnEu5QbzGroj08yN5+Qjk6XL0yz1wJG0sq/DjHMpNLeCrizUto9OPLYH
+8pgtRPDIY/krmwDE7MjadGM66+2mcwjCAmjPXbSUrdAYjck9MwqdEI678qusvTE1
+3VvpwdevJ4hGW9eoMGe6NO/JuL8sk4yMg3mxfn6w7pv8F6olRR7BJWfkVPHW834z
+rkEgy/ppAkAqq05MpWu6gd+keDtvqSKCf/+HptCGuCf9fdtT/+jn4QWzK0+EIySI
+Yiw8Yk5iYdHS6Fp2O6HEyAvV1q56GHUT0QqWMrQrNmUCCttzD0YXAckUAuw=
 -----END CERTIFICATE-----
diff --git a/script/test-certs/helm.key.pem b/script/test-certs/helm.key.pem
index 1ff297d9f8b..c62d23efcc9 100644
--- a/script/test-certs/helm.key.pem
+++ b/script/test-certs/helm.key.pem
@@ -1,51 +1,51 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIJKgIBAAKCAgEA0AX4ijpOZGccqvoTQcm/IwhKvLgJRAD+oUgSyuiTwnnNHF+M
-E/2YmNVHDraz7mMu4oJjbvmnDrCuS7TXupIpECehCntIRVvkcDYKp1Ds11l+xMZK
-CggYigAukeZ4nCZPl1uE/F0y0vU3cRHsxf6Op+yrDIP6R6aPj3H/K5YlOd58VPX9
-twyl6cYXY6A+/uPZTKMm1MTVe5lKi4mUj1P/RNAtR8dzjimYYHR24IVZbmywiXk5
-zUJSLzU4TQbtsStSkn+UrbEf7XXOFBsUS2LocIiUzpBQCM/jF3tVGwfUoFwqs15O
-qqa4fCSCci/HABY/HduPNGhue4WlCLGKDwXF3wrI6V9M0pf5CeX0icpbvXq/0/1M
-o8+FAZ6OVC3UHooGXCmIiNEJSp7kESZNT9+t5zrR3NoyqIBFulIFEyivNdWa0Pbl
-JMdG2Tmv5znixTfi12QnEepHteC94OrmG0Uzpr1RXAek6/M0ua+pHdjV3LCo1wj9
-qRMk3m/7ACtVz9eztAKORrm6IEzVSgbbeEeNTV3vQIpnKJ/n6HH2xAC0jYqFnry9
-VmEMjhFBsmzH1jXrVswVmtZyS3UEPDPovuf8JimBz1sVXlgCiA/TG1OzJUXl6kaO
-YgfKiJGL96sWb99rxB1/E/RLuH64B4Y389l81cqh2lxQ2rK/Msi+IFbk+/sCAwEA
-AQKCAgEAjJn8izEtmx82eTndmjHKRttr6HJbkOM7N7eHPC5G8MNypyLNgxV89o/x
-HzjOFOpk3iRTIMcM6xjwNatdxHTV3F1ss7DwADFEDbP5L227JzMOQ+HiWTVvoJbO
-4z5rdt9OHHd3QzubBotHld0PtCOCOG32jtcFazhhAAuE9Oje8GY4kxRREFA0M/X4
-CRZefdlzHiGINXd0872AbR/okZesic5LTKC6sfPbUhZl4ws+jyxXhhOxxdJ1ygKm
-syljrsQhY3NoAp4dflqJl31WEj4f7S/jpFpWPh6E13I867A3PswM8H9lnGJjf0UO
-Bi/UyXI/5uZnvHx5cHO8QEv/jHfSbN6pxhLauhgfK/WHQlKAbQ9aKKQ/F2mn9j3+
-VJllEyj/44wfal9K7hJnhFQCMP3i2pMJmOAUY2rjt0hnQwLCjgw3O12gf5NHe4MC
-P6uiaohTDOQEhJZ2o36uxV0Db10nbXQkOzo5K9pt2b29CT7MtyXp9naVKKilpqqS
-E04+Wa8mky2bzczMjsNXcSTFuMZ6j0DNojpe+RMTW6fkpWjNLFSCvdr7Qm8rJq0U
-0a5cEimnGMHIeG1DDPI7KnRPgb3BHa4alOU+J1L9ZsdNefJ6byMdJwL4nCCL1SdB
-Rn6vqlqBg2NSMEkMx5SmjsergBB2M9w91Fu+woUrUEC3yvfypAECggEBAO+DNF2h
-aoxezVllWnZ24JHWJCha1IQ9g2bCDkVnam5i7W+mkA2nknqIyLVMmdPW/1AaQRuU
-rINNjl9xFIgkN2DJhs+jCH0jQFVsvvV6RBTc+3gu4jtF5hditLDJfPKvJRfPlqIq
-21wfK93vLnZQp25lmmrLW+6ZkwOQy/NXfVmvK+DmOLiacAcgwSXZpNzrjdEG8F/d
-4KLciMNIac8jlSLwwDa7hI+5rlM3EVxQeCRAbVUlzUDWWCadKHn/NmDSKToaKvi0
-Qd6T3co5l/ue8dFZcIq+hzvPVGD+ltF730/7YpKplqc6tkh0Fwcb7+pCqOWRw+SE
-v45TAAH16G/Ex0ECggEBAN5X2Y0boo/Hhc2vXWnLERBDSghnr7YtR1l59fhdpqo1
-LvIWLdkI9uXE48TJwXc4ReCdL5e0HEOTC1/uUSTVbT24ya+goTzr5Ekc0D/F0Ovs
-6JhqbZMEQDKqQahsKZ+NF0ll8Qz1beqqix3tfgrHeUz7jFKsvAaMOSjcsVPFUMvI
-UjKtNphAH+H86XAzom4Ug+N57x69Uj2buZbqMfwDDBc7QNS85iWTqS80BCBWcg4x
-WQXuxewvqBk7f0VAX3EAT5tZYnR8USD1Ycub0UupquSYn3XQsS3cGfT3FU2d12D/
-TcW0UYtoS6uSqCZfVY/DX8jldMbuvuHD36uA51FXEDsCggEBAKILrv46G5BlA6Ic
-BJxpyX5h14zGB0qBI8n+ORGT6lpM7D/B/Wx/l4b3zHN9JAZDS/GyEaLLb/xWGKFS
-LIX/msgNEPyiXTftBbXGIVyMIEvNRwYFEmLv48Cms4F4kOTQwtPdSxjkzg0Bufgp
-vtGlt+HlNBhVBhnkJacf7BzzcIehEJrUqEOdmXX5HzSwj+44IHbvruntf/IwKweU
-kqHmfRxqrmFZdVKYWe1LMJ+4gdBlFpOpQ7k+S920LpJ7rRrMlcANvE0QCBDDEiej
-18QRwaHWVWJJjc1VdM068mdA29GNTx/TRW5XNsTGZl4U9LkV6JeJi3OsrL1qQnMR
-IPWduQECggEAaVdh4TL4n/o98KdnMJpfKT9YMgc9/qgRJ9laqiNktTuhVF0ht7RB
-lbbk2vVjzeJBaRvP0qYoxfNC7l5w32ym5xlHpQgLnFt+uw0FtVE5nK2Pvbae14qq
-B9cWaH9mcQtdvw6nWCZnv0ixxKoij2TWmZyMbRcdtlR1OGDnOvM/Rm1QVGYweY3Y
-DS/QQbKVAGaD3iCFJCE6d6nyEgg/SlD/R3pxStl8iM0e2Rhh5BhQzVyf+umXqEEj
-+WBw+hR3o4gsL0P4G4xSu7TGcrsOPDTUnJ2a3yzS5RFk0uTFmRJxWqla5ZJ7F/t/
-7nf7ZsLAPO6p0Pq1ixLOKRSuQgk+jxEaxQKCAQEAsogwUsgET2DvfjBdhLa5XnFi
-3y1nXZrdwPQ0Mxxm/Un/QtryYcLlzJR/mgjuWyO7K+Y4vbzwWV9WqflJetqNCX1W
-Zeld7Gf4zCYQF5JC1y4RVmIjRoUQzBAms4HWQuHR6LUeUfWAIttnckakcstxFBiL
-CZ+XxthlbPptfdDGqARaLbPAG7TVRpQF5eBPu83twbo8w9UoUOxi8tSD+WGGXxaE
-eLwoIx/OlmAmjlgT/wz1SdaM1rCfnvJf3ynu3B3Up8OFHfZ3En7E6jbc+jH+QgvP
-Ntp586xmYqFn+AerAJQxfkV5SodGgS74U2wCCBLMRpT4i8dbwKdcWEN6r+8/5Q==
+MIIJKgIBAAKCAgEA9Q+erh8wIgiZMetmDqfNNUenHEXgGX7claArHwcZg+P8EEba
+zPZnOewBIcxesOwiHVW0o5RWKqJhlso5qgp7UkqieKYHJcoBYmX+Pcbk2KngDxLA
+rgnD9LLgyJO9LBLW/HB1xbqCJsFpdq9TIyBCMpCnz+EF09azFZQqulMHxhBqX9TJ
+tfXXq56Bal/3YLC0gmDoyqKzMkKxTp+YhB0mVCagnkNvWWvoZKnVAO7ZEoZCHgiu
+Yw7eBSbbWXxqW4tlyHgAOP3f1dIlwxBXNcq/2GWxYE/nqlGk8hOgpCKMf0PeXptP
+ZOZCHQOJBaYKgkVR/05HYqPPt5WkjTn9vuPekG/UFora3wblzNieiao70yjUU8RA
+Bps0Eiahjcan2WOWv4NjSKimRZjkJn5WpZumKdKy5RlFAJ/4LNiJKAPJJi8zBER9
++ml2BiUJmmSjujKgbLgX8kA68sdl6VyvZYLRYFpyikOJw+hLW4iD7FalMYo4riOa
+kf40W9pnfuC+Qp9zZs3bpwDAjC0++xTdiKl2Is3iDTGDTFJLisgk7w0Mjb2iQvyF
+0CLPP2cnjaBP80rZVkxXXLmPIa2D16wNvT9AwPYqxR/DA0b5WsvKr1gYwg1sKmdQ
+q9l7rjxomeHGpuuYw9JnC12mKaPJGPG5MOREcUrQULHMLn1Oelq2KC6qrWMCAwEA
+AQKCAgEAiLgdLEGkJeisJ0iQWK7PcuE13zUwsKixQhzo0dexKX8BOsd8/IqfzpXX
+j9aoIYasBbeyHuz8Ia8USP8rqq1MXf3bpPnj1PZdTVtfu3GCbUphAafRrYcvNw6x
+D9Y03Sjpnk7Tteu2/w4624c3F8rAg9tmdDizeps2sFxIdkkqdhrkbfCWVJkCqPG2
+e/VsWxpaqr6MQbkBxpGkwBuUCGkG4D3osEMpFTd5oOeLOYkHvCkBLCZlvEgoH7Gt
+AMDDyaz8rRod7a3dujoS7T/pl840t/MMQZJyyffg0VmX7tqDjeD8Z8W4Rq+bxPoa
+8PbQuBsagxhWBTclBORMuKnY4i3ZFZ6DIUTNzbCV01+u0tyzW9eEH3I8/VZEm9zk
+b/UicDc2FOBiMPOkM9UFpmUVirqqnGzrjG6Bj1j2noNxoKoVaY9CZDMDny4XnoXc
+j8a3UAcvXl0Y1Y9/QoLAuskzZrknAg1qRjzBjCT6Qrl0779WH4DvszY5M0pGtskz
+Tble4s2V03qadRPUn5mQvpbJb8Jes9qfIuvoNjUpGpHijGiU2x2afK8BoY9/7lXw
+7c81WDvonchUHaW2e3nw67a/YfrFQbvpBVvCejl9HO7tMeYWwyBgsooFlM7OWO0Z
+CaS68sNh0VxFkE2d4voazlZUhZVKvM1qHrSHNLLNh04caSGGJrECggEBAPtiFzLN
+pqhQVVZ6wASN2ZivL3cM1kv9DWH0cmgSgx6v2XLD0YB8NC0pEAV8aQ2PZWZlUZBU
+cVwINdJxzZd9u0vJDPBI9AQ9MY7q9o7p+uCdVm3uuLsoi9JYC8sC5DEEBYcu4xSH
+3tIA+U8m9Iji+lrGKa+sDlSCD//PhmWqjpm191xQUbsyGsY/iLByFhASKKSUpBMM
+UDuwGymg4C0snOETTj0HUm3AHENCD8+a7+L8y1JahZ/WHCwDnIQvDjoAKjHRByfT
+KwHBiQ4CReklSxzTbWVTUIJQNccNZufyZXXq+SjOKDX+NNNN8MBgjAiwxTBrW+bF
+KtQuunIN4P6q+ykCggEBAPmPzgn/RP9merKRjh9vpIeDKORgMOjmlUrE3UvQ9dTV
+AH/w631oa82WyBAYQ+CUXltYZfmcFhBUJc7h7FMdwzO1coMyOt/e4/AFEpdpHI6v
+bY32mTHNjiUq5b2LbhiiyJYqeH8kctL10DNNWJBrHdpj6wGLH3A9vzvsJQGdnqoJ
+EsRlEk5my/zmZNyGdMACGZ4Iifhjmnuzh8u9Csx1GvkZi0IdL4a9cY8m/kly5qX3
+g+e/yU0vBn9DvVM3VwtOmkYM12n1lhPOJ63KT32NQOhLQIVjW4UUC4YyBHc+sNbL
+T/AFHT77777KHjxKcDT21eFzZlOi8hYmzKzfX0CjwasCggEANH3+JCCnXVwxBbbq
+I8lPF7/1JGHs2b9ErSCzRyIeeSj1Oi7Dr5W/+3Ioo0ygTzGTVfdwObg4V6RrQL98
+09ZwZtnbts01DzGMCLDtvVgEiCSyqJABySslT04NYF4BMm8JjHnw9xeMIsQLS0jy
+JSdoac4ZZFKER4dFOgCmqtIbpuNFfORUvMcwqhcYPugDzWVNUVisjkGy+1PByEaM
+qUI4nBNA8iN2Re6ouC6ySIKs9vQcrNy0LHU0OsiiRUPiL6BbLz3bxaglwd8c9Gzr
+Fk0wSxunK1JjbGK9aAxXYbXPE/l1/9xUrzme5ETRMgq3ExV+h6bTcPPZBqefTTOy
+uNsRSQKCAQEAyNfB4uvMlJrd7i4UKhqIWALnevwrAJTp21WaH3UZEuMlVtIGQ1Qx
+RjCt674Liob9dRgsYXkLjLKcBuZtcerG+Sty8EERfq/702PRtYcDU5W9Xn3yhlE+
+r4zZffTjcvI26hteBDzKKBtqJo990iRSzzqQnBph/8vBxrDii21VjtRkhSguVmiG
+jI7C53NSLGDESxnmJ7/JSPqQNBh8w1UPkx/Kojeo0xBNfv7LsULGexU609zWXcaV
+vQBAMuObqt7ka7HT/1OFJ4VHC6eA17NBZHGDiJYQxoX+TE6ep3UNjp/rQmhrRBAv
+vuUc9jqWGRn5wUpFNNQzbj5lhE70cqoXpwKCAQEA7wofY9x2MQjNu9RW/Mx7GkRY
+m+n1f6tc+DTRt4BiA0EQi83PsboLQTUGZ24rqBPMfZ3e45E9eiYNyFdgyAfAEp4k
+HQqt44uH48epELAFkLyfpX+GhIUPdfWsHbXexvQPgckzKTjyf1p7bebLhs+wM1ZO
+CHXDrVvoywKlIxJldeBD8f3QY7G/TJgT16ZMNM37sm+pvv9P9gem5jmQKsjFtD2W
+zw4Czih1JvVXKK9VHg7RCl4kOjJws/xxZB8fJ3hw8bPBpo8AuFLu2NjCNg7KCf+R
+uv1K0xF70I6BOi7Mp1y0/uJdB++Bj4lMVlYXS+QIwVXLI8iM51ptOwJYZYZqbw==
 -----END RSA PRIVATE KEY-----
diff --git a/script/test-certs/tiller.cert.pem b/script/test-certs/tiller.cert.pem
index d5601119ec0..77afd69ad64 100644
--- a/script/test-certs/tiller.cert.pem
+++ b/script/test-certs/tiller.cert.pem
@@ -1,28 +1,27 @@
 -----BEGIN CERTIFICATE-----
-MIIEszCCApsCFBCLdNSO4+LHZUmF5XkvJcjmniYAMA0GCSqGSIb3DQEBCwUAMBYx
-FDASBgNVBAMMC2t1YmVhcHBzLWNhMB4XDTE5MTEwNTA1NDIwM1oXDTM5MTAzMTA1
-NDIwM1owFjEUMBIGA1UEAwwLa3ViZWFwcHMtY2EwggIiMA0GCSqGSIb3DQEBAQUA
-A4ICDwAwggIKAoICAQDdQP0IQd/JJGgEH3fRaQ4fZfdXwhzenx8DBgKKNZnTRDCn
-BqeVSPPfB+PZSCcbZ110sm2EWkl+dypagcp9cQlEsucfqGELsz75Kzj++mU/S/LQ
-HexIqZ/kGy2IWP3fqU3wK5XgMmr45+qIXCDa7ED7ElkxKhDtB7pVJdijaQtyZCWH
-Kizyuuz32bMKCc+f8leR2UgiDEKfkE8xfXWFKQj2uby2yP6w/cg+M5myXDiSRo6d
-nRjw+j+j0BAmSmwRSYXLa64uA8V6geZ2MPLK9Q/1NjRAa5M24oG0PSHpBSA89ka1
-gcmLJVkV9fIy1H0t+JmyuEiDagHHjJbcHr54ANng8q5xNd0zIRbkcrP9GkGbKPCT
-LxoD4RC8YYOl6/OZxczOZVHm7TlvrI1g9AkONp6QuMMxTGLjJ0hJmR+Cx3KD7DD3
-BrVtCq5Qmk5TCg67lMMyACtADXGPF9712qYIKAOlEmurOUSdtxASpQaRVyvFekw2
-adMVONRAza3VQgyl1oUQ1ay52mGphP1BgGIZHIfuL/emnnW8sjZq0QgVpKhGpmYb
-EcyLYxarkwX36ur6n3wYBYsjSqbKXWspwO0uqsmEo5DIBNPhpLW7E4YoIn67A0v2
-V+3CfyjoarNvnC/KytYqvzd7U8KQvdjKtkixUPiHqc0KBzE0herqJFnQyEAMtQID
-AQABMA0GCSqGSIb3DQEBCwUAA4ICAQDT5rnr63TLzK3y6J8tiqARTacyysCwHw8u
-6EV0QTDuKsz3k195If8VQ6pSUKtLmcERZmFdTjI0YvySrpzoM9Yii9qsvtDU0i3p
-WKwbpvO2umtgAvwMtxVLjqqUU2JBNGusTMdCoqr5o9Amb6zSq/xHG4k1GEcZuqH/
-Qkk/NpDXg3hGCl7JXR4oTN/tr9fUNJfMz7/TVY7fJqFCN1AE9woE01Vn1Ma2YR8T
-gVeFgfZyMiHoOfqJ7oYrK4UvgjbF/jshEpE+SnEDbl0zYPdaWn9wBGegJHq9wGWw
-FD8cmoLJdMpHrGguj76Tk8PeXrvdwMhKmNCFyU/GGEYLbvQk89WCciLAR+WQFpxh
-ZUJ/ktwkVZao37frmu2B4QMqXH2MJmqikSu2171ML3wiypXCcDnnazy7yvO8FsIH
-9ZUaHqzVGhe4mf2LN5QugjfupOAf39evfVnV6JWSMmB/K9jjbb/cIbhfsW6+MinN
-7g3/uxS4MCB5fxgGXEzPkv3Q9ETtrkNyR13mxUuXbnHIIze29udaZtA9QBkt/qwz
-OHVpfGKNRaiVlSeLKGajiDAQzXqjOz+TfJ0PchNHPcQvLKu/TE8RN6GJlHRR9Sxc
-HgxxiAExiKpqXKBsWfKPnYBm+BcYS8o3QCWRVLYvHziBcLfUg5fSoi7sMAKKF4l1
-ZdJHjQLvbg==
+MIIEqDCCApACCQDQ1XUVemTFBDANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtr
+dWJlYXBwcy1jYTAeFw0xOTExMTMwMDQ2MzlaFw0zOTExMDgwMDQ2MzlaMBYxFDAS
+BgNVBAMMC2t1YmVhcHBzLWNhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
+AgEAn8fj3jy5g+WmIrED9e6Rn1TJVzbhEKvSfX+uiNFSLpHe2bXrBmguyNgwzcAZ
+neBb/1drAuk+AWHTTStm+ZZ+lxtQoZxiNKXjb2jaxXn5+o4IZBFaiKiQ36mN9MaW
+xDObMQ8WYtgikLgd2xx7fuiGEYJENdIfjxHrzlM0Tlbcn6TME2IXPH82zvENqMPm
+bsW7Lsb8gZu+vlrV3gAb+skzwzBCHvwBq/dTAZUdgPuyBnrtDYuXy8a2MIAQMNL9
+SWd3I+sH2AkvSWMQlWoxl1Z7Jaxe8/JwsZaeef7SCMKCwCUSB/vD3LEhAfgOisv9
+dOTRji1KbMH/PTylTPEe+4d7c7hsvM9mB8hDkglolWwoTU5G8uDK5zW5a/DYQzCC
+godSSC5NiCqNknk1BpKqB/L7qjzmrDmA9rGQvuKl5R48z0brSEpSzjkUvNleAlLQ
+Jq84mk5m19Xv3ExReFD13O0+J37bx1CRBikuAinDTDVzsWtpWteky3JleA0FSZ5b
+fwEM0r5sut/0BLndy7KH4DvKWCXI9aP8z6PsVyS2GCLeYx5YzN4txmXHofMFj7pi
+TlCp4ycpFe3RwZd6C1RSpHhyZdJu+bWHe81B4m8S/Alxjilts/kGU0CgZ0gBhmYx
+0fKzDka9326uzQfEGtsUVoGF95a++jb/xrwM2CoZTUYYT0MCAwEAATANBgkqhkiG
+9w0BAQsFAAOCAgEAjmghap7oyceGt6hMV+Ml0Br9fXD0vR8Gab2fhZq8YMuYMe2u
+B0hJ153KpMzPwE+vJGB+MG8qas5IlweKgcywnCtVS6e7ec33w/VovtDpZS4o0YIS
+KE6vPgIA0DEkmcHMD88k019tOjnhshTvZH6P7QV4Secq+MVJC7eVHCyiVyVJcDA1
+NO7f3SIqUpLUBFYfY4/Py3CHw5/0fb9lEYXIoDr2N58fQB4EtbiwYfTcOdjhyw4m
+Y1EoBQkud1KkVkh/Pq4UjL3uNd0JmBu4/hagbDp8OUyf+hSIlXFjdjbt4BAHktNq
+UvBbK8s2vWWGPr77oHZv24uFwNxvElO5OoY+euBRTmqdN3iV0c5nbP7L36bBDI0d
+lbiIqg4P/EzJq6tbsSYFrgwDpGUOBqpr0gZhOEmS3dsGFU+ejZlpuJniwGDcRC9Y
+5lAoaDesQ038pfCOsjDXAmQX1e768jHXBlAncPnx9fiVl1tuKkqw7TmtZ8e3z9gT
+R4OmwmtxiduODpv07Ark3Gp93NgFKygKVj2Hj4JjJwrslwJ5zQ04FBR6sHoInD1R
+PKjFiDYgmhy8yjpTXBE5RImbPyuq2cSfMg6M06K2IMzEc6zEUfECW0ZOwblKoy5h
+tUNjfRKr//+bO+r0o09XaBRkl7gmlIT2wWVShrtCvPjLR9vChtkNdyTM6X4=
 -----END CERTIFICATE-----
diff --git a/script/test-certs/tiller.key.pem b/script/test-certs/tiller.key.pem
index 09d1e501e72..536e5704eef 100644
--- a/script/test-certs/tiller.key.pem
+++ b/script/test-certs/tiller.key.pem
@@ -1,51 +1,51 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIJJwIBAAKCAgEA3UD9CEHfySRoBB930WkOH2X3V8Ic3p8fAwYCijWZ00Qwpwan
-lUjz3wfj2UgnG2dddLJthFpJfncqWoHKfXEJRLLnH6hhC7M++Ss4/vplP0vy0B3s
-SKmf5BstiFj936lN8CuV4DJq+OfqiFwg2uxA+xJZMSoQ7Qe6VSXYo2kLcmQlhyos
-8rrs99mzCgnPn/JXkdlIIgxCn5BPMX11hSkI9rm8tsj+sP3IPjOZslw4kkaOnZ0Y
-8Po/o9AQJkpsEUmFy2uuLgPFeoHmdjDyyvUP9TY0QGuTNuKBtD0h6QUgPPZGtYHJ
-iyVZFfXyMtR9LfiZsrhIg2oBx4yW3B6+eADZ4PKucTXdMyEW5HKz/RpBmyjwky8a
-A+EQvGGDpevzmcXMzmVR5u05b6yNYPQJDjaekLjDMUxi4ydISZkfgsdyg+ww9wa1
-bQquUJpOUwoOu5TDMgArQA1xjxfe9dqmCCgDpRJrqzlEnbcQEqUGkVcrxXpMNmnT
-FTjUQM2t1UIMpdaFENWsudphqYT9QYBiGRyH7i/3pp51vLI2atEIFaSoRqZmGxHM
-i2MWq5MF9+rq+p98GAWLI0qmyl1rKcDtLqrJhKOQyATT4aS1uxOGKCJ+uwNL9lft
-wn8o6Gqzb5wvysrWKr83e1PCkL3YyrZIsVD4h6nNCgcxNIXq6iRZ0MhADLUCAwEA
-AQKCAgBphG/oOzpVvBYbOUK0TSzeDov6f2mzRiHNGFWnwk5dMh0d2w+bI5KioCmq
-2z1DVXV9jQar4z8/n+dECLggQQNRjxyovW2i3dY/kLx65cHZgQgI9uxT7wmBCPEb
-II3a1+yCiNbOeF0J3di9NWq53YhT9PkyeERgNppHt2fs7tD1ugsnvhZ3oGwY++rl
-863gMvxOY1iCXGR9op4SFSox2lMbD5OPfKXylOWlvIglRtP39sxXIK/fZQlqv3Sk
-PkPxrqWvUOhdq5DHjyHw5gE0h9EXecVLn8Iyn62J3snITpiEWlN4hrAuux4UWhoq
-4andfb0XPcnfWnQEzei4i7T8mDNPsEOcaQ+D2sLrnibp0dWEypOZSbl5MZQ/Ki/V
-VIcsjYzwTYkek0J3G4l3qNvjd2MOg25I30LIZKBCZH0Szy+gQBRkfHTzxXiF6yWU
-TdvW0S2gMBA0D2R9yGubJVFcIokGA+jblBjcqgPWT/TZsAeBrl+rkENlN01jmnFC
-WoF6VFTYqJpJx/+2+gfvcJ5hx9H2YgzEC9dBYMoPWfAGjCbF2QnxmXGCdJw8xlji
-E0HGaXwGuehnhAuwLtnIkwulyYKe5Q8rkGPhBFVaSt9p/fsJ2DMKNHRiOnib6Qrm
-KY98zXrNqVvuHCMfla4i0Qx3O+VMEEkv0DReTJ0Q0xF1Bv5M4QKCAQEA+izU4iMY
-hFLeMavyOQcqzlNEQaOove700iMDFqfpYdaUiAuJtabWjgDMz8rSdEEwAmpyLy0n
-GWu549BCthj2jmnVc5dmrbBPufQ0rQo5y79sVUA/ozimH57qlyRUwVZY+x23ICFS
-He6bw+9vz17emEnUCwS5idhSxg5BvYSEkZDH9mCu8b6aCU/ImxPyVq3scd3gAyEu
-WuD2yeOTGEswNPE0ct9I4l539SgYKn2saTxAmKm47Eyf1K+5Ng/95ZQz1h96MRCd
-JDxHx46i1oKdx48oW1Egm/EAw4SlWHpzw2pO3HeVG206XCekRNt2+TjOAW66He/Z
-rNIqIwPudTN0uQKCAQEA4mfFjbFuQvkY1HWgP03Dh5YcHCKES4Za6DKErA9B6JTZ
-HsfRK2i9nfVzXjIoXp9YrnG99oMADMZp4KSHfyR2+8uqBkyi3hM20JSz8kJM2UDU
-qtdPaMSeAEYb0VUdesR0u9kqqjlhHbnGl73MTJSC6ISd4moXjDOT/8UEfmopXQJE
-KK+hS67SkBbsa72TBw00hD2NTLrfUF49nf7i2lxmT+jHCuMrb9U1u7dkBZ+GfO5y
-6vu6jT4DS9nfa9PjI0AbjrWmdD1Duu2nnfVE9KnjqLcw0dwc4VHIyxvTtF/JBOKs
-AoQ1vBY9FyJqRt+skTGuwEh9yLQ5pKP4xhcFDrQR3QKCAQAhWhKzZxxgn6+RjavI
-IIV7ZixmV8wqLg4jaZmCzrXVXkcE8AzW07wsyDyFwzNVXk9pMwmv8mQRBoSMs3oB
-Tsin6cIUG+4LX8LxNnZDT2avHAD0SJFzUB0NgCEkLyrBb6KDL833EZoh9Wp8r5IH
-Yk1ongcPxPx7PQSj9Mic3GrUASo3VWJdRhzA+wryabFYDu3DrGGt6SGF6hHcjmNQ
-zM1LcZCdc9kCnLd/Tm4SVBjFGsw9zfqiPgDc2ORnKbCeh6h1dlLS8bURXJvxJbnd
-wSIJtbMaoXEoePOyHR/x8Lk4JxcGW0bcli4+lOZYa62rwf/svvc/AHfTi10kt+R1
-aXu5AoIBAFU+IvhlXJFkvj+IBgyvl7XeA7loGY1iCaoxExjBKdyK5nCbZRrF9daa
-SpSlp+NwdXBArPg6fHNS5RxKdiWdshq9pMd4ZT3d2B6STmohIlQN/8RPCrv0g1Sx
-ENoxBMdrXlQ3wMOUlQcfIjGRqXEP3XX0MInFzhXgeZGsOTPrfqVhLA5xifY33VmY
-9+zc1JWsGCDOF/xSw6+7u9FX3Uu/zFm71+02eO1DRlbmBofDd1xkXuowWx3Awnb1
-khREE9n60iVaKVDMnEquHhTv+sVvjaLBTmVFTa5cH5CxanUYN1Raj87mvmCRsvCZ
-6Y/DuXJ1VUlaQdmmWamufwT+N85AaBUCggEAdbfOf3oUJaET1p2SfNDA6nm+q0Vy
-JVLBow2ffk+Wb+d8YLOxPqyFdnN9unXz3AKllXn0F7JpGai6UZmzj/GgKhOxkD+N
-eyeUHJeCq51h2OmQAZrq4hkrwgU4DIp6u7b15r4AWTWsUFzZDTJyxOlI+w+bveRr
-FNCamWwQfrF7oa4Y3bG+KSOlKKAuyEqefAN1QX1J/n/mFerQx48T1aLpXhA8FrYL
-qrf1wvWeQTLqZavkmnJXfCL1fjXczrvsklzC1eHmOqoWm6l8Np3Bh7Tcx1jZe91G
-eHs1GAns3392xwTtY/WJlVCjMvNpweJJuWeBr4snD3QLV0gesHvht9ZroQ==
+MIIJJwIBAAKCAgEAn8fj3jy5g+WmIrED9e6Rn1TJVzbhEKvSfX+uiNFSLpHe2bXr
+BmguyNgwzcAZneBb/1drAuk+AWHTTStm+ZZ+lxtQoZxiNKXjb2jaxXn5+o4IZBFa
+iKiQ36mN9MaWxDObMQ8WYtgikLgd2xx7fuiGEYJENdIfjxHrzlM0Tlbcn6TME2IX
+PH82zvENqMPmbsW7Lsb8gZu+vlrV3gAb+skzwzBCHvwBq/dTAZUdgPuyBnrtDYuX
+y8a2MIAQMNL9SWd3I+sH2AkvSWMQlWoxl1Z7Jaxe8/JwsZaeef7SCMKCwCUSB/vD
+3LEhAfgOisv9dOTRji1KbMH/PTylTPEe+4d7c7hsvM9mB8hDkglolWwoTU5G8uDK
+5zW5a/DYQzCCgodSSC5NiCqNknk1BpKqB/L7qjzmrDmA9rGQvuKl5R48z0brSEpS
+zjkUvNleAlLQJq84mk5m19Xv3ExReFD13O0+J37bx1CRBikuAinDTDVzsWtpWtek
+y3JleA0FSZ5bfwEM0r5sut/0BLndy7KH4DvKWCXI9aP8z6PsVyS2GCLeYx5YzN4t
+xmXHofMFj7piTlCp4ycpFe3RwZd6C1RSpHhyZdJu+bWHe81B4m8S/Alxjilts/kG
+U0CgZ0gBhmYx0fKzDka9326uzQfEGtsUVoGF95a++jb/xrwM2CoZTUYYT0MCAwEA
+AQKCAgBtEKXzaiH77YNVBN2+PuW6C8cPuE8y8QZSUhiSHcfqL/odQ/c0vWLKCABw
+QaN6x84kYsiSCSIhEWSJtYmp7tdkT+nfFv9WDrJLtxg2WgePxunlXI8e32lcssFK
+h1Ach1l0yGawe/ZEMNl4Wl3WB+SUCQaEcnTGVSZQBS2cF+CrPHNs+7T+v5tq8NIx
+E9+0V1ZpHLz5v5UZHKoFyq9OpY6musc3nS+K8d0AJIgqJiSkFb7AUzv/hhmQy6nB
+mhP4yh5iLymAhux3PJ7yTrWhJxASbDG4dRIFttlgTteR0Sws+mDvgCR2/ZWZYXiT
+t6C/7P05/qJh0J5ob4AqICDU8usJwzTNcSBdDF/NT5Y2AMJ1NwiMs4dwdEjN/KbQ
+H8bAIZJTKQHZdATigCeAx/TGEmbfF6Dlqg33gNQ99TNL/6D+mOTJF2mBqI8AAN4W
+10uvO1k6bqOTvpv49LlMUCb0oP0TF0jWloQy/p58w0YafZRm37tNypWJ/OMWwAzz
+PXMFSyEa9sMr4qJj+Y2bPLjVtBQnzIADHsBT4n4lObWMfuOQvngaxHzOa7mqqfRz
+itsmjLoTPH3texuOrtffD05+7hmO8uECNEFrDwc1jhvJVfjtLiBOUAdhWFMwsMCr
+nZPnd6skt9W9qeD4gLlaAIZxLvmJoLb3kTMMWX/C7JteIKVkSQKCAQEA1HuJZRBK
+TzJXXxpH3rm7aZTf1JgzFFo3LT3ElD4v07jQcv6E1I/w+6ZaBQY/D+ysZpOqXX8/
+ohgJPyeHKoz+7d25KqN2cW8RPe7PES5NyK400niHJwg+NAZpSSiUilATyNSrCFvV
+YOU5wo07HlMnEUbKerOSgb6mduXnAq7glg85dU4H7tGdJvnsPFdWeyG8nv3HAkSz
+fmpuiVX1Bf535UwM7qBaAoBlTU8pBKuVgW+c6dW2hBerqBBrlSWSdx1x+soczeWK
+BAwPfVSr22d6SjtFN+tt6UZ87sP7kX7TG2aDioH39PElAWEEwfRa2SyDf6h1RmJp
+Kw6N2PMHGRNYVQKCAQEAwIEzSjWczd2PzEibB+AhC/uGfS2mkzuWUH6pQ2JlUi5m
+THwk+tEIHn/Xaa/zZihc2LL9lbxErbJjguEOwG9wbS1XqMiFmasI8AfnR/VZJ68V
+zyvwhRAUKMuyUmxDZBT5FO/zrxnkEP4liidyZ58k9tdjlZ3tR33RhFaoczPhIBLt
+I7RxqOWGMhhN8Kn96+8DY0TYuEfhcINkc0dVk+pmJNO5CWGDtcTVhFliJyMg2MrP
+XGjrHNUOtI13E0iSXXxRYxM6cGMwU1odAox3h50RMYIIBT7k/+JWDExSV33gzjsd
+S+/gc0yfIMlDw94FOqeb8NuQRoBjjgdEQTF5iTgBNwKCAQB108OO7Yenfy0AKdys
+36XTmKC+jV/V62kph1UZN5rh91xwSD90eBWUFt1YZ+xUclPv1fblPgkVY+rMwKit
+qd48HXXu9RJbONIA3AqrZlfv7tqP1BJuTJ3hz6RW00/7mwg9l+D4E6SxxKtQ/WxJ
+FqdVZ0Ik5Ktbk1NQH5EI5dzYmbytFgZEIqzYzkJ3+56TTVQBfoz67wnyEicVtTrY
+hhIKby/Eq9r+BCEoy7rdQiD30+LZsI8zlMS1v9VIsbsUnpl0DtwGOUFdmSqFv4xF
+cI5Z16A8sCsU7uecp8U7G28JhMFw7z2G8Koqp5gxzcULJSoOgmX2D+Bt5fY21h2b
+hCS5AoIBACM/hQSxjGSljQ76vGhUwbhP9fA1y6pp3rwedR/BhIvnsxOOJ7dFTxdG
+kUrozMiH23hSTdx8/JZRc6cjTnAt94gGJWbiUJQynRBWYiLq6cg6ZuPoR8IVj5to
+sN4mtLA+pt0OkrAdLYVvA7CoSGpw2XPZPILIyAmvIA37UBzIAxC8Zm+DOsySOmAx
+0xOeDMCGozgqAwS7JKxVYq85AJJ0+P8FRXxSPqupvu7c7vv7kqgfepiRHXvKB0dI
+H+WIBETZ3o0lmC27+71HYsh0r+5E9ED8bjuHqKax6s+Vqf4bLm6UpGijI5X5EaoP
+MDlNDegPiJ4xldlS6Oe4rObDCF33w0ECggEAShb/el5T0sFXWdyZvJv3zSoAtr+B
+h0E/pMWqL598Md4k3PtWxW16pEE5U4f2CE9lUrXU5cS81frwCtK0d4v2a+JM35/k
+/W3QQ0eUC9QChX/38cEZjWD32t4vSajfTBMsphqksXzNGclRpFmB237PBOihlWg4
+1xiOFDKPeEuUv6cyDvbcXCTr8OMAC5mAf+6s29ijSVELnstsiCXiyxSjsnmH4HzM
+w5dlUmxNjJISDhDRkWNYwrAqCHYIV81AeFTP4RoL2LhiTkrHeNztIAx0PC/nAxO/
+sXl3kd+YdzRBYB3EfrSmHocIUJhdLiCNDaN0eDZ0mPaZvuGcQXyWMAPS8Q==
 -----END RSA PRIVATE KEY-----