Comment 2 for bug 1871669

One more w/a is available: you can use strictly confined snap, but the CA has to be in /home/<USER>/snap/client-keystone-auth/ ... directory:

ubuntu@juju-41d808-k8s-3:~$ /snap/bin/client-keystone-auth --keystone-url=https://keystone.orangebox84.ru:5000/v3 --domain-name=admin_domain --cacert /home/ubuntu/snap/client-keystone-auth/ca/cert.crt
Please enter user name: admin
Please enter project name: admin
Please enter password:
{
 "apiVersion": "client.authentication.k8s.io/v1beta1",
 "kind": "ExecCredential",
 "status": {
  "token": "gAAAAABfNrki1YMtVj_peMFU092fQAiUgIxSuxOoeykcjNf8U6sL1Qp-Axdw8ulJVtrw_1KzvKVAgeUjo9NDRcny_kRuXBwmXMzEvXsduyYAX5XrjGCvENHFLMk5ZGaR1jII1thf_lFc7-yTFdIFx2HvuWzMBWNpteOTz_4wRu1WDf9FvnDIBnE",
  "expirationTimestamp": "2020-08-14T17:17:38Z"
 }
}