How to make ingress use my TLS Certificate in Microk8s

Question

I have the following Ingress configuration:

apiVersion: networking.k8s.io/v1        
kind: Ingress
metadata:
  name: http-ingress
spec:
  rules:
  - host: example-adress.com
    http:
      paths:
        - path: /apple
          pathType: Prefix
          backend:
            service:
                name: apple-service
                port: 
                  number: 80
        - path: /banana
          pathType: Prefix
          backend:
            service:
                name: banana-service
                port: 
                  number: 80
  tls: 
    - hosts: 
        - example-adress.com
      secretName: testsecret-tls

And i also created the Secret:

apiVersion: v1
kind: Secret
metadata:
  name: testsecret-tls
  namespace: default
data:
  tls.crt: path to .crt
  tls.key: Zpath to .key
type: kubernetes.io/tls

But when i connect to one of my services and check the certificate it says that it uses a cert created by Kubernetes Ingress Controller Fake certificate. When i run microk8s kubectl describe ingress i get the following output:

Name:             http-ingress
Namespace:        default
Address:          127.0.0.1
Default backend:  default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
TLS:
 testsecret-tls terminates example-adress.com
Rules:
 Host               Path  Backends
 ----               ----  --------
 example-adress.com
                    /apple    apple-service:80 (10.1.55.17:5678)
                    /banana   banana-service:80 (10.1.55.10:5678)
Annotations:         <none>
Events:
 Type    Reason  Age                From                      Message
 ----    ------  ----               ----                      -------
 Normal  CREATE  28m                nginx-ingress-controller  Ingress default/http-ingress
 Normal  UPDATE  20m (x2 over 28m)  nginx-ingress-controller  Ingress default/http-ingress

What do i need to change to make my Ingress use my Cert instead of generating a new one everytime?

Have you tried adding `tls.crt` and `tls.key` as base64 encrypted values? It seems like k8s doesn't get paths [Reference](https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets) Also you can create a secret using following command: `kubectl create secret tls testsecret-tls --cert=tls.cert --key=tls.key` — moonkotte, Apr 27 '21 at 08:36
Thank you moonkotte. I tried it out and both of your suggestions work it seems like i really had to add the encrypted values instead of the path. — timmmmmb, Apr 27 '21 at 09:10

score 3 · Accepted Answer · answered Apr 27 '21 at 09:20

Posting this out of comment as it works.

Based on your tls secret yaml, you tried to add certificate and private key using paths, which is not supported currently (reference) Fragment from reference:

When using this type of Secret, the tls.key and the tls.crt key must be provided in the data (or stringData) field of the Secret configuration, although the API server doesn't actually validate the values for each key.

Therefore there are two suggestions how to move forward:

Add base64 encrypted values for key and certificate to tls secret
Allow kubernetes do it for you with the following command: kubectl create secret tls testsecret-tls --cert=tls.cert --key=tls.key

How to make ingress use my TLS Certificate in Microk8s

1 Answers1