GKE ingress only have one certificate when multiple are described in the ingress.yml

[carlosflorencio]

Hi,

I am trying to configure multiple certs for sub domains using kube lego and google cloud platform.

I have two services, one for my staging pod and another for my production pod.

My ingress config:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: restaurants-s
  annotations:
    kubernetes.io/tls-acme: "true"
    kubernetes.io/ingress.class: "gce"
spec:
  tls:
  - secretName: staging-restaurants-tls1
    hosts:
    - staging.otrack.info
  - secretName: prod-restaurants-tls1
    hosts:
    - otrack.info
  backend:
    serviceName: srestaurants-s
    servicePort: 80
  rules:
  # Staging
  - host: staging.otrack.info
    http:
      paths:
      - path: /*
        backend:
          serviceName: srestaurants-s
          servicePort: 80
      - path: /.well-known/acme-challenge
        backend:
          serviceName: kube-lego-gce
          servicePort: 8080

  # Production
  - host: otrack.info
    http:
      paths:
      - path: /*
        backend:
          serviceName: restaurants-s
          servicePort: 80
      - path: /.well-known/acme-challenge
        backend:
          serviceName: kube-lego-gce
          servicePort: 8080

The sub domain is working fine: https://staging.otrack.info

But the main domain has the wrong certificate: https://otrack.info/

My load balancer only shows one certificate, is this normal?

The secrets have been created with success by kube lego:

Any ideas?

Thanks

[simonswine]

The GCE Ingress controller that is used for your setup supports only a single certificate:

You have these options:

• Setup two ingress object (one for staging, one for production). Will need two googe cloud forwarding rules
• Modify your example to use a single certificate:

  tls:
  - secretName: restaurants-tls1
  hosts:
  - staging.otrack.info
  - otrack.info

[carlosflorencio]

Yep, thanks the answer!

I switched to use the nginx controller ingress.

[jzhu077]

@simonswine I ran into the same problem. If I use

tls:
  - secretName: restaurants-tls1
    hosts:
    - staging.otrack.info
    - otrack.info

How to update the ingress, so that it can start to get a new certificate? The current certificate is for the first domain. And is it possible to use a single certificate for two hosts?

[dan-turner]

Doesn't this imply that GCP's load balancer does support multiple certificates?

You can configure the target proxy of your HTTPS or SSL proxy load balancer with up to to ten SSL certificates

https://cloud.google.com/compute/docs/load-balancing/http/ssl-certificates

In the GCP UI for the load balancer created by kubernetes there is even an option to add extra certificates.

[artworx]

I am having the same issue as described above, I am using GCE Ingress and want to have multiple certificates.

According to the google console: "Each forwarding rule can have 1-9 additional certificates".

[Salmondx]

Please, make it more clear from the documentation. Add this workaround for GCE in the README because it's pretty hard to find the root of the problem.