Custom certificate issue on Ingress controller installing with Helm chart

Question

I am using the ABP framework microservice template. I have deployed the application on Kubernetes using the helm chart.

I have the following helm chart configuration in values.YAML is provided by the ABP framework.

    authserver:
  config:
    # configuration sections
  ingress:
    host: auth-server-v1.mydomain.com
    tlsSecret: mysecret-app-tls
  image:
    repository: myrepository.azurecr.io/auth-server
    tag: 1.0.0
# same configuration for other services and gateways

image:
  repository: nginx
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
  tag: ""

podAnnotations: {}

podSecurityContext: {}
  # fsGroup: 2000

securityContext: {}

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: false # don't know why its disable
  className: ""
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  hosts:
    - host: chart-example.local # don't know what domain should be here
      paths:
        - path: /
          pathType: ImplementationSpecific
  tls: []

#install application command

helm upgrade --install name-st name --namespace default --create-namespace

#Ingress yaml configuration.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: name-st-angular-ingress
  namespace: default
  uid: 385d12fa-7fe6-4ca7-9d16-b851ac4c7e2c
  resourceVersion: '11744926'
  generation: 1
  creationTimestamp: '2022-05-21T08:10:39Z'
  labels:
    app.kubernetes.io/managed-by: Helm
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    kubernetes.io/ingress.class: nginx
    meta.helm.sh/release-name: name-st
    meta.helm.sh/release-namespace: default
    nginx.ingress.kubernetes.io/force-ssl-redirect: 'true'
    nginx.ingress.kubernetes.io/proxy-buffer-size: 32k
    nginx.ingress.kubernetes.io/proxy-buffers-number: '8'
    nginx.ingress.kubernetes.io/rewrite-target: /
  managedFields:
    - manager: helm
      operation: Update
      apiVersion: networking.k8s.io/v1
      time: '2022-05-21T08:10:39Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:cert-manager.io/cluster-issuer: {}
            f:kubernetes.io/ingress.class: {}
            f:meta.helm.sh/release-name: {}
            f:meta.helm.sh/release-namespace: {}
            f:nginx.ingress.kubernetes.io/force-ssl-redirect: {}
            f:nginx.ingress.kubernetes.io/proxy-buffer-size: {}
            f:nginx.ingress.kubernetes.io/proxy-buffers-number: {}
            f:nginx.ingress.kubernetes.io/rewrite-target: {}
          f:labels:
            .: {}
            f:app.kubernetes.io/managed-by: {}
        f:spec:
          f:rules: {}
          f:tls: {}
    - manager: nginx-ingress-controller
      operation: Update
      apiVersion: networking.k8s.io/v1
      time: '2022-05-21T08:11:10Z'
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:loadBalancer:
            f:ingress: {}
      subresource: status
  selfLink: >-
    /apis/networking.k8s.io/v1/namespaces/default/ingresses/name-st-auth-ingress
status:
  loadBalancer:
    ingress:
      - ip: #.#.#.#
spec:
  tls:
    - hosts:
        - auth-server-v1.mydomain.com
      secretName: mysecret-app-tls
  rules:
    - host: auth-server-v1.mydomain.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: name-st-auth
                port:
                  number: 80

#Created the secret by following command.

kubectl create secret tls mysecret-app-tls --key cert.key --cert cert.crt

All the services and ingress were created successfully but I got the certificate issue and not serving on https. Invalid certificate.

how you are creating the cert ? key and crt file and adding it into secret? if your cert is self signed it wont work — Harsh Manvar, May 21 '22 at 12:44
The certificate is not a self-signed certificate. We already have a production website and certificate and I created the secret from that certificate. — Imrankhan, May 23 '22 at 06:38

score 1 · Answer 1 · edited May 26 '22 at 13:03

1

If your cert is self-signed it will give the invalid cert address or not have a proper Common and domain name.

Looks like your ingress is getting created from here

ingress:
    host: auth-server-v1.mydomain.com
    tlsSecret: mysecret-app-tls

You can accordingly change the tlsSecret to once which stores a proper certificate, not a self-signed one.

You can also use the cert-manager which will auto-create the certificate signed by let's encrypt and save it to secret.

Cert-manager : https://cert-manager.io/docs/

edited May 26 '22 at 13:03

Fariya Rahmat

2,123
3
11

answered May 21 '22 at 12:46

Harsh Manvar

27,020
6
48
102

The certificate is not a self-signed certificate. We already have a production website and certificate and I created the secret from that certificate. – Imrankhan May 23 '22 at 06:38
1

you are using clusterissuer in ingress although you have already manually installed secret and created it. please check clusterissuer secret is not overriding the existing secret when you are creating the ingress into the cluster. – Harsh Manvar May 23 '22 at 06:49

Custom certificate issue on Ingress controller installing with Helm chart

1 Answers1