<p dir="auto">The comments imply, to me, that specifying --cert-dir will cause the apiserver to look in --cert-dir for some appopriately named certs and will use those. This is in lieu of the user specifying --tls-cert-file and --tls-private-key manually.</p>
<p dir="auto">Two problems: one, the flag descriptions don't tell the user what the cert/key need to be named for them to be auto-picked up. Two, the code doesn't actually look for those files in the --cert-dir. It just clobbers them with Kubernetes's own self-signed certificates.</p>
<p dir="auto">Of course, it's also possible that I'm just misunderstanding the description of --cert-dir. In that case, I think it would be clearer if --cert-dir said "The directory where self-signed TLS certs are placed".</p>
<p dir="auto">Relevant code: <a href="https://github.com/kubernetes/kubernetes/blob/master/cmd/kube-apiserver/app/server.go#L621-L622">https://github.com/kubernetes/kubernetes/blob/master/cmd/kube-apiserver/app/server.go#L621-L622</a></p>
<p dir="auto">(note, util.GenerateSelfSignedCert says in a comment that it will replace any existing certs)</p>
<p dir="auto">It seems to actually overwrite existing ones</p>