New TLS certificates are not reloaded by nginx-ingress-controller #947
Comments
|
Following up. We are able to force the nginx-ingress-controller to reload by applying a dummy patch to related ingresses. For now, we might be able to workaround this by having a job that applies this patch every week or so. |
|
Hi, maybe it's related to the issue I have reported yesterday, nginx is not reloaded after a new ingress is created - #945. Do you see the same problem, or creating and updating ingress resources works for you and nginx is always properly reloaded after these events? |
|
@stibi: I don't have the same problem as you have with ingress updates. For that matter, any updates to the ingress causes nginx-ingress-controller to reload. In my case, I might be able to schedule that patch command to run every week to force ingress reloads. This works around letsencrypt certs not being reloaded. |
|
ok, thanks for the info. I wonder what I have wrong on my side, in case it works for you. |
|
@juliohm1978 please update the image to |
|
Closing. Please reopen if the issue persists in 0.9.0-beta.11 |
|
This issue still exists. |
|
@jerryjxj please post the ingress logs |
|
@aledbf , this issue can't be produced everytime. I just tested again with more steps
|
|
@jerryjxj from the logs there's no secret with name
|
|
@aledbf |
@jerryjxj we are using the watch from k8s. The periodic check is to dump (to a file) just the secrets that are referenced in ingress rules to disk and not ALL the secrets being watched |
|
@stibi your patch is already included in beta.11 |
|
@aledbf yes I know, I have deployed it already on my cluster…but I thought that maybe there is a similar problem with checking if the configuration has changed…as I'm looking on the logs provided here, there is a reload triggered, so the problem is something else most probably, sorry for confusion |
|
@jerryjxj please update the image to |
|
I was finally able to test this again.
I noticed the last few lines of Notice that the tls secret event is received AFTER nginx config is reloaded. Certainly doesn't make sense. |
All the processes are sync, nginx can be reloaded by a change in the endpoints, configmap, secrets and ingress |
The secret was changed. A new cert was issued. Shouldn't it have reloaded? This is still not working as expected. |
|
I believe I'm seeing the same issue with |
|
Looks like it's when I refresh the ingress. When it gets reloaded due to a new ingress being added or an old ingress being removed: and if I look at secrets The current solution for me is to just use the |
|
@aledbf I'm also seeing the Logs from the Logs from the I'm able to inspect the NGINX config with Seems like There is an Ingress for
And there's a Service with no External endpoints:
Versions
|
|
It seems this is caused by the |
2 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I'll be glad if #879 is reopened, since the issue persists in our infrastructure -- still following up on #879
Using
kube-lego:0.1.5andnginx-ingress-controller:0.9-beta.10.Given it's a brand a new installation, kube-lego was able to create the first certificate for ingresses. Even though certificates were successfully issued, nginx-ingress-controller kept presenting the Kubernetes' default fake Acme certs.
Only after a restart of the nginx pods, the new certificate was loaded.
As a side note, this is reproducible using LE's staging environment. Every time we clean up and fire up related pods and services, nginx-ingress-controller does not reload the newly created cert.
My steps to reproduce this are:
The text was updated successfully, but these errors were encountered: