validating webhook should ignore ingresses with a different ingressclass

kubernetes / ingress-nginx

Ingress NGINX Controller for Kubernetes

https://kubernetes.github.io/ingress-nginx/

Apache License 2.0

17.42k stars 8.24k forks source link

validating webhook should ignore ingresses with a different ingressclass #7546

Closed lazybetrayer closed 2 years ago

lazybetrayer commented 3 years ago

NGINX Ingress controller version: v1.0.0

Kubernetes version (use kubectl version): v1.20.9

Environment: Bare Metal

What happened:

Before v1.0.0, there's a check to skip validating ingress with a different ingressclass: https://github.com/kubernetes/ingress-nginx/blob/f3c50698d98299b1a61f83cb6c4bb7de0b71fb4b/internal/ingress/controller/controller.go#L224

In v1.0.0, this code is removed. With multiple ingress controllers, both will validate the same ingress. If we create two ingresses with same host and path but different ingressclasses, the second one will be rejected.

What you expected to happen:

skip validating ingress with a different ingressclass

/kind bug

afirth commented 1 year ago

@MarkKharitonov did you follow these steps already? if so, and they resolve the issue, it would be great if you could PR some docs or at least open a docs issue

[ ] controllers for class X and Y running in separate namespaces
[ ] electionID set to unique value on each class controller set

MarkKharitonov commented 1 year ago

@afirth - Are these steps relevant if the ingresses live in different namespaces, as is my case? It was my understanding from reading that comment that having ingresses in different namespaces eliminates all the issues naturally.

Have I missed anything?

MarkKharitonov commented 1 year ago

This is false alarm. I have found the root cause. It is actually educational.

We copied the nginx images to our internal image repo in Azure and never refreshed it while we did refresh the HELM chart deployed.

This is a lesson for us to improve this rather broken process.