CODEWITHSUNDEEP
kuberneteskubernetes-ingressingress-nginx
e.dan
e.dan

Reputation: 7507

k8s nginx ingress TLS rules: cert vs. paths

I am struggling to get my nginx ingress (on AWS EKS) working with path rules and TLS.

The ingress is from here

A snippet from the Ingress looks like:

spec:
  tls:
  - hosts:
      - example.com
    secretName: ingress-tls
  rules:
  - host: example.com
  - http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 443

This ingress creates the AWS network load balancer, with a URL like https://xyz.elb.us-west-1.amazonaws.com/

I am updating the ingress-tls secret with a certificate using cert-manager.

When I access the ingress using the NLB URL https://xyz.elb.us-west-1.amazonaws.com/api, I get

  1. GOOD: Correct routing based on the path rules from the ingress definition (i.e. it ​goes to my api-service as expected)
  2. BAD: Certificate errors since I'm not accessing the ingress with the domain that the certificate is for.

When I access the ingress using the correct domain e.g. https://example.com/api which is what I want to do, I get:

  1. BAD: 404, it doesn't respect my path rules, and goes to upstream-default-backend instead.
  2. GOOD: certificate all good, it’s the one for example.com that cert-manager configured.

I tried removing the host: example.com from the rules:, which gives me:

  1. GOOD: Correct routing based on the path rules from the ingress definition
  2. BAD: Certificate errors, it serves up the default ingress “Fake” certificate instead of the one for example.com, I guess since the host is missing from the rules, though not sure of the exact reason.

Can someone please help me get

  1. GOOD
  2. GOOD

I’m at a loss here.

Upvotes: 0

Views: 176

Answers (1)

e.dan
e.dan

Reputation: 7507

After staring at this for several more hours, and digging through the nasty chunk of lua that is the nginx.conf for this, I found it! Maybe someday someone will have this problem, and might find this useful.

The problem was:

  rules:
  - host: example.com
  - http:

This is defining (I think) a host with no forwarding rules, then then some http forwarding rules without a host. What I had intended was obviously that the forwarding rules would be for the host.

And that would be:

  rules:
  - host: example.com
    http:

I have to say that I'm now even less of a fan of YAML than I was previously, if that's even possible.

Upvotes: 1

Related Questions