jx: TLS seems to be broken on applications when using boot
Summary
- Enable TLS when installing with boot via the cert-manager and external DNS
- Create an application with either
create springorcreate quickstartand deploy it with Jenkins X - The certificate for the application public endpoint form staging environment seems to be invalid
The application ingress resource seems to still have the expose controller annotations:
apiVersion: v1
items:
- apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
fabric8.io/generated-by: exposecontroller
kubernetes.io/ingress.class: nginx
kubernetes.io/tls-acme: "true"
creationTimestamp: 2019-09-03T08:13:40Z
generation: 1
labels:
provider: fabric8
name: bdd-spring-1567497978
namespace: jx-staging
ownerReferences:
- apiVersion: v1
kind: Service
name: bdd-spring-1567497978
uid: ba295232-ce22-11e9-bb9b-42010a84003c
resourceVersion: "8133"
selfLink: /apis/extensions/v1beta1/namespaces/jx-staging/ingresses/bdd-spring-1567497978
uid: bcc72597-ce22-11e9-bb9b-42010a84003c
spec:
rules:
- host: bdd-spring-1567497978.jx-staging.boot.bdd.jenkins-x.rocks
http:
paths:
- backend:
serviceName: bdd-spring-1567497978
servicePort: 80
tls:
- hosts:
- bdd-spring-1567497978.jx-staging.boot.bdd.jenkins-x.rocks
secretName: tls-bdd-spring-1567497978
status:
loadBalancer:
ingress:
- ip:
kind: List
metadata:
resourceVersion: ""
selfLink: ""
No cert-manger issuer seems to be installed in the stating namespace. The cert-manger fails with the following error when trying to acquire the certificate for newly deployed application:
I0903 08:13:40.282576 1 base_controller.go:193] cert-manager/controller/ingress-shim "level"=0 "msg"="finished processing work item" "key"="jx-staging/bdd-spring-1567497978"
I0903 08:14:04.218156 1 base_controller.go:187] cert-manager/controller/ingress-shim "level"=0 "msg"="syncing item" "key"="jx-staging/bdd-spring-1567497978"
I0903 08:14:04.218406 1 sync.go:77] cert-manager/controller/ingress-shim "level"=0 "msg"="failed to determine issuer to be used for ingress resource" "resource_kind"="Ingress" "resource_name"="bdd-spring-1567497978" "resource_namespace"="jx-staging"
Steps to reproduce the behavior
Expected behavior
A valid certificate should be acquired for an application deployed in the staging or production environments.
Actual behavior
Jx version
The output of jx version is:
COPY OUTPUT HERE
Jenkins type
- [ x] Serverless Jenkins X Pipelines (Tekton + Prow)
- Classic Jenkins
Kubernetes cluster
Operating system / Environment
About this issue
- Original URL
- State: closed
- Created 5 years ago
- Reactions: 9
- Comments: 32 (15 by maintainers)
Bumped priority.
@tdcox @rawlingsj same here on my application’s Ingress:
Could not determine issuer for ingress due to bad annotations: failed to determine issuer name to be used for ingress resourceWill that work for previews and devpods?
I’m currently using
which seems to work quite well and catch anything with a broken/missing cert. I wasn’t able to get it stable and working for previews and devpods when I was trying replicator a while back.
@srehmanproov You can check with @daveconde or @deanesmith on slack. I don’t think is done.