x509: certificate is valid for ingress.local, not <external_hostname>.com

kcp-dev / helm-charts

Helm chart repo for KCP

Apache License 2.0

4 stars 21 forks source link

x509: certificate is valid for ingress.local, not <external_hostname>.com #31

Closed yogesh-reddy closed 1 year ago

yogesh-reddy commented 1 year ago

Installed the latest helm chart. and followed https://github.com/kcp-dev/helm-charts/pull/30 to create admin kubeconfig. When tried to access kcp with the generated configs..

kubectl ws create ws-1 --enter
Error: Post "https://**.com:443/clusters/root/apis/tenancy.kcp.dev/v1beta1/workspaces": x509: certificate is valid for ingress.local, not ***.com

hardys commented 1 year ago

Can you provide the values used here - is externalHostname set to ingress.local or ***.com? (where ***.com is an externally resolvable DNS name pointing to the ingress endpoint for the cluster)

yogesh-reddy commented 1 year ago

external hostname is set externally resolvable DNS name.

Can you provide the values used here - is externalHostname set to ingress.local or ***.com? (where ***.com is an externally resolvable DNS name pointing to the ingress endpoint for the cluster)

hardys commented 1 year ago

I think ingress-nginx must be using ingress.local for the ingress endpoint CA cert?

I'm not familiar with how to fix that but perhaps @mjudeikis can suggest something as it relates to the work in https://github.com/kcp-dev/helm-charts/pull/27/

yogesh-reddy commented 1 year ago

@hardys @mjudeikis here is how I tried the kcp installation

Installed nginx ingress
Added a DNS entry for load balancer URL for ingress controller
installed a chart by providing the DNS name as an external hostname and enabling ingress
tried accessing the kcp with kubeconfig generated using the step in #30

Let me know if anything different is expected

yogesh-reddy commented 1 year ago

Also @hardys i was looking at ingress resources.. looks like the secret name is not set.

should spec of Tls hosts contain this secret name ? secretName: kcp-front-proxy-cert

mjudeikis commented 1 year ago

I know ingress might be with a few hiccups now and secret name might be wrong. I have bunch of changes in my fork, but I want to merge #27 first. TL:DR: There might be issues :)

yogesh-reddy commented 1 year ago

@mjudeikis found the issue. the ingress was not honoring the certs .. so we need some extra configurations in ingress to honor the tls certs and add some lua scripting to forward these. i am able to access the kcp locally now.