Default certificate does not exist about kubernetes-ingress HOT 6 CLOSED

Hi @Roxyrob , can you confirm that you're using Helm to deploy the Ingress Controller ?

from kubernetes-ingress.

Hi @ivanmatmati,
yes I'm using helm or ArgoCD using helm.

I use specific namespace. I tested with single and multiple instances each on dedicated namespace. Sometimes it start and create default certificate sometimes not... I tried to see log and delete/apply ingress with different configurations of tls.

No luck.

from kubernetes-ingress.

Ok, the controller doesn't manage the lifecycle of default certificates. It's handled by Helm charts. I suggest that you ask in their repository, you'll get an answer.

from kubernetes-ingress.

Until this issue is identified and resolved I found a WORKAROUND that seems stable enough.

Following this link: Haproxy document SSL / TLS

1. Manually create a certificate

openssl req -x509 -newkey rsa:2048 -keyout example.key -out example.crt -days 365 -nodes -subj "/C=US/ST=Ohio/L=Columbus/O=MyCompany/CN=example.com"

3. Manually create a secret

kubectl create secret tls haproxytempcert --cert="example.crt" --key="example.key"

4. Temporary Change haproxy ingress ConfigMap

     kubectl edit configmap -n {namespace} {configmap_name}

       apiVersion: v1
       kind: ConfigMap
       metadata:
         name: ...
         namespace: ...
       data:
	 ...
         ssl-certificate: "default/haproxytempcert"    <===  (Add) 
    

Doing this seems "to wakeup" ingress controller that create default cert using haproxytempcert.
Default certificate now exists and contains my Self Signed certificate.
Now I can:

4. Delete "ssl-certificate" from ConfigMap

     kubectl edit configmap -n {namespace} {configmap_name}

       apiVersion: v1
       kind: ConfigMap
       metadata:
         name: ...
         namespace: ...
       data:
         ...
    

5. Delete secret

kubectl delete secret haproxytempcert

Default certificate survive and now contains default haproxy Self-Signed certificate.
What one expect from start.

from kubernetes-ingress.

Hi @ivanmatmati,
I'll ask in helm chart repo also if the deployment process is the same for times when default certificate is created and times is not.

Thank you

from kubernetes-ingress.

Noop, Helm Chart seems correct and this is not related to Ingress Controller either.

from kubernetes-ingress.