Kubernetes ingress controller not able to find the certificate secret

Question

I am setting up a secret containing the certificate for ingress controller but getting the below error when I check the ingress logs

Ingress logs:

W0304 05:47:32.020497       7 controller.go:1153] Error getting SSL certificate "default/auth-tls": local SSL certificate default/auth-tls was not found. Using default certificate
W0304 05:47:32.020516       7 controller.go:1407] Error getting SSL certificate "default/auth-tls": local SSL certificate default/auth-tls was not found
I0304 05:47:32.114777       7 main.go:117] "successfully validated configuration, accepting" ingress="hello-kubernetes-ingress" namespace="default"

Secret:

$ kubectl create secret tls auth-tls --cert key.pem --key out.key
$ kubectl describe secret auth-tls
Name:         auth-tls
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  kubernetes.io/tls

Data
====
tls.crt:  3231 bytes
tls.key:  1732 bytes

Below is my yaml file for ingress

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: hello-kubernetes-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/auth-url: https://externalauthentication/authorize
spec:
  rules:
  - host: hw1.yourdomain
    http:
      paths:
      - backend:
          serviceName: hello-kubernetes-first
          servicePort: 80
  - host: hw2.yourdomain
    http:
      paths:
      - backend:
          serviceName: hello-kubernetes-second
          servicePort: 80
  tls:
  - hosts:
    - externalauthentication
    - hw1.yourdomain
    secretName: auth-tls

How did you install your ingress-controller and in which namespace? It might be permission related. — ITChap, Mar 04 '21 at 06:54
I enabled ingress-controller via minikube addon and it is running in kube-system namespace — Divya Vyas, Mar 04 '21 at 07:32
`secret` and pod `hello-kubernetes-ingress` are on the same namespace , they should be on the same namespace — Thanh Nguyen Van, Mar 04 '21 at 07:51
@DivyaVyas Could you verify if both resources are in the same namespace? — Wytrzymały Wiktor, Mar 04 '21 at 12:35
@DivyaVyas, any progress with this issue ? Did you manage to solve it ? — mario, Jun 04 '21 at 14:01

score 1 · Answer 1 · answered Mar 11 '21 at 09:42

Both the Ingress and the Secret are namespaced resources. You can check yourself with:

$ kubectl api-resources --namespaced=true
NAME                        SHORTNAMES   APIGROUP                    NAMESPACED   KIND
...
secrets                                                              true         Secret
...
ingresses                   ing          extensions                  true         Ingress
ingresses                   ing          networking.k8s.io           true         Ingress

They can only work within their namespace. So in your use case you need to put both of them (Ingress and Secret) in the same namespace.

I also have this problem, but my ingress and secret are in the same "default" namespace. — tyolab, Oct 21 '21 at 05:39

score 1 · Answer 2 · answered Aug 18 '23 at 10:44

We also experienced this problem in our kubernetes cluster.

We have a setup where the tls certificate is provisioned in a azure key vault and copied to the cluster using akv2k8s.

It turns out that the order of certificates in the kubernetes secret was wrong. In order for this to work the order should be:(from the top of the file to the bottom)

Leaf

Intermediary

Root cert(not mandatory)

If the order of the certificates is not correct the tls key will not be able to verify the public key and kubernetes will not recognise the secret as a valid certificate.

score 0 · Answer 3 · answered Jun 07 '23 at 18:59

For anyone else experiencing this problem, I just wanted to add my experience from just now. I was getting the same error saying it could not find my TLS cert, which I had added in a different namespace. The problem was that the cert was not defined correctly. I deployed it from my git repo where I have the crt and key values both set to the crt value so that my key is not in the git repo. I forgot to go back and update the secret's key value with the actual key. This misconfiguration for some reason resulted in ingress saying it couldn't find the certificate. It appears to be simply an incorrect error message.

Kubernetes ingress controller not able to find the certificate secret

3 Answers3

Linked