Description of problem:
Client is using LDAP as identity provider without TLS. For insecure connection ca certificate declaration should be ignored but it is taking into effect.

https://docs.openshift.com/container-platform/3.10/install_config/syncing_groups_with_ldap.html#ldap-client-configuration

Here is the details:

master-config.yaml
-------------------
oauthConfig:
  assetPublicURL: https://master.example.comn:8443/console/
  grantConfig:
    method: auto
  identityProviders:
  - challenge: true
    login: true
    mappingMethod: claim
    name: ldap_provider_name
    provider:
      apiVersion: v1
      attributes:
        email:
        - mail
        id:
        - dn
        name:
        - cn
        preferredUsername:
        - uid
      bindDN: ''
      bindPassword: "********"

      ca: /etc/origin/master/linux_provider_ca.crt <=====
      insecure: true <=====

      kind: LDAPPasswordIdentityProvider
      url: ldap://192.168.100.1/ou=People,o=unixteam?uid

With this configuration the master-api did not start. After changing the value ca: ' ' i.e. empty it master-api pod started working.

How reproducible:
 In master-config.yaml file , if following ca value is used , the master-api pod  does not start.

~~
 ca: /etc/origin/master/linux_provider_ca.crt 

~~

Actual results:

if insecure=true is used then ca value should be ignored as per documentation 

Expected results:
ca='xxxx' whatever , master-api pod should be started 

Additional info: