kube-lego managed Ingress resources

[jrnt30]

I have been attempting to fully automate the provisioning and binding of ingress resources on AWS using nginx-ingress, kube-lego and external-dns. kube-lego behind the scenes is creating a shadow Ingress resource in the kube-system namespace to manage some of the TLS challenge process.

The issue I am running into is that the external-dns' Ingress source assumes that if the external-dns.alpha.kubernetes.io/controller annotation is missing, it should make a DNS request. Ultimately this has lead to a situation where the resource in multiple, identical changes being added to the batch.

A few ways this could be approached would be:

• Ensuring the set of endpoints ultimately being added to the change set are unique
• Provide a "strict" flag that ensure that not only the equal to the expected value, but that it also

As an additional scenario, I can see a situation (especially using path based ingress) where one may want to represent the same Host attribute in multiple Ingress resources with different paths which would lean me heavily towards the de-dup to unique records prior to the call to ChangeResourceRecordSets

[hjacobs]

👍 the de-duplication approach sounds reasonable.

[linki]

Ensuring the set of endpoints ultimately being added to the change set are unique

This is fixed in v0.3.0-beta.1 which makes it work with kube-lego.

The --strict flag still sounds reasonable.

[linki]

Moving this to v0.5.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.