Roxyrob
commented
9 months ago As written in the referenced haproxy ingress controller issue, Until this issue is identified and resolved I found a WORKAROUND that seems stable enough.
Following this link: Haproxy document SSL / TLS
-
Manually create a certificate
openssl req -x509 -newkey rsa:2048 -keyout example.key -out example.crt -days 365 -nodes -subj "/C=US/ST=Ohio/L=Columbus/O=MyCompany/CN=example.com"
-
Manually create a secret
kubectl create secret tls -n {namespace} haproxytempcert --cert="example.crt" --key="example.key" -
Temporary Change haproxy ingress ConfigMap
kubectl edit configmap -n {namespace} {configmap_name} apiVersion: v1 kind: ConfigMap metadata: name: ... namespace: {namespace} data: ... ssl-certificate: "{namespace}/haproxytempcert" <=== (Add)
Doing this "sometimes" seems "to wakeup" ingress controller that create default cert using haproxytempcert. Default certificate now exists and contains my Self Signed certificate.
If ingress controller DOES NOT wake-up, leave the haproxytempcert secret and ConfigMap annotation (ssl-certificate) to be used by haproxy ingress controller.
If Yes now you can delete temporary secrets and ConfigMap annotation:
-
Delete "ssl-certificate" from ConfigMap
kubectl edit configmap -n {namespace} {configmap_name} apiVersion: v1 kind: ConfigMap metadata: name: ... namespace: {namespace} data: ...- Delete secret
kubectl delete secret -n {namespace} haproxytempcert
- Delete secret
Default certificate survive and now contains default haproxy Self-Signed certificate. What one expect from start.
Better to know why and where this happen.
dkorunic
rcazzatoApk
ref: Default certificate does not exist #601
On haproxy ingress controller v1.10.10 I get this error in logs:
ERROR global.go:272 default certificate: annotation 'ssl-certificate': secret 'namespace/namespace-default-cert' does not exist namespace is custom namespace (not default).
I cannot use this ingress controller in https. If I manually create requested certificate that controller will remove it.
Sometimes ingress controller seems to deploy and auto create default certificates, with the same ingress configuration.
I know I can create custom one, but I need to know how haproxy ingress controller check and choose to create or not its default certificate to support tls without custom one ?