Impossible to request certificate when ingress for path / exists

[tobilarscheid]

Hi everyone,

we just faced the issue that it is impossible to request certificates with kube-lego when another ingress for the path / already exists. The /.well-known/acme path in the ingress created by kube lego is then not reachable. I know this is somewhat a limitation of kubernets-ingress, I was just curious if you guys consider this as a problem or not. In theory it might be possible for kube-legoto detect such situations and temporarily reconfigure the colliding ingress.

Regards,

Tobi

[munnerz]

This shouldn't be the case - the 'longer' (aka more precise) path should be chosen when routing.

What ingress controller are you using?

[tobilarscheid]

We are using the nginx ingress controller.

Why do you think the longer path should be chosen? This issue indicates behaviour in the case of having multiple ingresses for the same host is not defined by the kubernetes docs. Merging usually works fine, in the case I described above however it can become problematic.

[fascinatedcow]

I think the nginx ingresses get priority by name in this case. I worked around this by naming my ingress to something alphabetically later than kube-lego-....

[ankon]

I reported a possibly similar issue in the ingress project for the nginx controller, if you are using rewrite-target you might be affected by this: https://github.com/kubernetes/ingress/issues/495

[paulwalker]

@fascinatedcow That did not work for me. Did the deployment name also follow kube-lego-...?

Can someone please educate me on how to tell or configure GCE vs Nginx ingress controllers?

[jihonrado]

I am experiencing the same issue. I have the following ingress for my web (mydomain.com):

...
spec:
  tls:
  - hosts:
    - mydomain.com
    secretName: domain-tls
  rules:
  - host: mydomain.com
    http:
      paths:
      - path: /
        backend:
          serviceName: web
          servicePort: 3000

that overrides the one that kube-lego creates (mydomain.com/.well-known/acme-challenge ):

...
spec:
  rules:
  - host: mydomain.com
    http:
      paths:
      - backend:
          serviceName: kube-lego-nginx
          servicePort: 8080
        path: /.well-known/acme-challenge

When I try to access mydomain.com/.well-known/acme-challenge, it takes me to my web instead of kube-legos nginx.

I tried renaming my web's ingress so that alphabetically is before kube-lego's one, but it does not work.