k8s-ci-robot
commented
2 years ago @ldawert-sys11: This issue is currently awaiting triage.
If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.
The triage/accepted label can be added by org members by writing /triage accepted in a comment.
Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
k8s-triage-robot
UnrealCraig
chancez
ldawert-sys11
jstangroome
razholio
longwuyuan
SpringHgui
NGINX Ingress controller version: Release v1.1.2, build bab0fbab0c1a7c3641bd379f27857113d574d904, NGINX version nginx/1.19.9
Kubernetes version: v1.21.3
Environment:
kubectl version:kubectl get nodes -o widekubectl get nodes
helm ls -A | grep -i ingress:helm -n <ingresscontrollernamepspace> get values <helmreleasename>helm install values
kubectl describe ingressclasseskubectl describe ingressclasses
``` Name: nginx Labels: app.kubernetes.io/component=controller app.kubernetes.io/instance=ingress-nginx app.kubernetes.io/managed-by=Helm app.kubernetes.io/name=ingress-nginx app.kubernetes.io/part-of=ingress-nginx app.kubernetes.io/version=1.1.2 helm.sh/chart=ingress-nginx-4.0.18 Annotations: meta.helm.sh/release-name: ingress-nginx meta.helm.sh/release-namespace: syseleven-ingress-nginx Controller: k8s.io/ingress-nginx Events:kubectl -n <ingresscontrollernamespace> get all -A -o widekubectl get all
``` NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES pod/ingress-nginx-controller-59bd6dd5ff-4r7gm 1/1 Running 0 4d23h 172.25.1.33 loving-carson-65bdbd7d4b-2grqgkubectl -n <ingresscontrollernamespace> describe po <ingresscontrollerpodname>kubectl describe pod
``` Name: ingress-nginx-controller-59bd6dd5ff-tqkxg Namespace: syseleven-ingress-nginx Priority: 0 Node: loving-carson-65bdbd7d4b-dkltn/192.168.1.44 Start Time: Mon, 04 Apr 2022 11:38:01 +0200 Labels: app.kubernetes.io/component=controller app.kubernetes.io/instance=ingress-nginx app.kubernetes.io/name=ingress-nginx pod-template-hash=59bd6dd5ff Annotations: cni.projectcalico.org/podIP: 172.25.0.61/32 kubectl.kubernetes.io/restartedAt: 2022-03-25T13:40:04+01:00 Status: Running IP: 172.25.0.61 IPs: IP: 172.25.0.61 Controlled By: ReplicaSet/ingress-nginx-controller-59bd6dd5ff Containers: controller: Container ID: docker://9ecceaf892ffa0b48a9e088bd0ee5fd4eaf5b02dddc9fbad19a80078c9942438 Image: k8s.gcr.io/ingress-nginx/controller:v1.1.2@sha256:28b11ce69e57843de44e3db6413e98d09de0f6688e33d4bd384002a44f78405c Image ID: docker-pullable://k8s.gcr.io/ingress-nginx/controller@sha256:28b11ce69e57843de44e3db6413e98d09de0f6688e33d4bd384002a44f78405c Ports: 80/TCP, 443/TCP, 10254/TCP, 8443/TCP Host Ports: 0/TCP, 0/TCP, 0/TCP, 0/TCP Args: /nginx-ingress-controller --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller --election-id=ingress-controller-leader --controller-class=k8s.io/ingress-nginx --ingress-class=nginx --configmap=$(POD_NAMESPACE)/ingress-nginx-controller --validating-webhook=:8443 --validating-webhook-certificate=/usr/local/certificates/cert --validating-webhook-key=/usr/local/certificates/key --default-backend-service=syseleven-ingress-nginx/ingress-nginx-extension State: Running Started: Mon, 04 Apr 2022 11:38:07 +0200 Ready: True Restart Count: 0 Limits: cpu: 1 memory: 256Mi Requests: cpu: 1 memory: 256Mi Liveness: http-get http://:10254/healthz delay=10s timeout=1s period=10s #success=1 #failure=5 Readiness: http-get http://:10254/healthz delay=10s timeout=1s period=10s #success=1 #failure=3 Environment: POD_NAME: ingress-nginx-controller-59bd6dd5ff-tqkxg (v1:metadata.name) POD_NAMESPACE: syseleven-ingress-nginx (v1:metadata.namespace) LD_PRELOAD: /usr/local/lib/libmimalloc.so Mounts: /usr/local/certificates/ from webhook-cert (ro) /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-zw5m2 (ro) Conditions: Type Status Initialized True Ready True ContainersReady True PodScheduled True Volumes: webhook-cert: Type: Secret (a volume populated by a Secret) SecretName: ingress-nginx-admission Optional: false kube-api-access-zw5m2: Type: Projected (a volume that contains injected data from multiple sources) TokenExpirationSeconds: 3607 ConfigMapName: kube-root-ca.crt ConfigMapOptional:kubectl -n <ingresscontrollernamespace> describe svc <ingresscontrollerservicename>kubectl describe svc
``` Name: ingress-nginx-controller Namespace: syseleven-ingress-nginx Labels: app.kubernetes.io/component=controller app.kubernetes.io/instance=ingress-nginx app.kubernetes.io/managed-by=Helm app.kubernetes.io/name=ingress-nginx app.kubernetes.io/part-of=ingress-nginx app.kubernetes.io/version=1.1.2 helm.sh/chart=ingress-nginx-4.0.18 Annotations: loadbalancer.openstack.org/proxy-protocol: true meta.helm.sh/release-name: ingress-nginx meta.helm.sh/release-namespace: syseleven-ingress-nginx Selector: app.kubernetes.io/component=controller,app.kubernetes.io/instance=ingress-nginx,app.kubernetes.io/name=ingress-nginx Type: LoadBalancer IP Family Policy: SingleStack IP Families: IPv4 IP: 10.240.20.72 IPs: 10.240.20.72 LoadBalancer Ingress: 195.192.153.120 Port: http 80/TCP TargetPort: http/TCP NodePort: http 31006/TCP Endpoints: 172.25.0.61:80,172.25.1.33:80 Port: https 443/TCP TargetPort: https/TCP NodePort: https 30351/TCP Endpoints: 172.25.0.61:443,172.25.1.33:443 Session Affinity: None External Traffic Policy: Cluster Events:kubectl -n <appnnamespace> get all,ing -o widekubectl get all,ing -n APP-NS
``` NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES pod/nginx 1/1 Running 0 30d 172.25.0.50 loving-carson-65bdbd7d4b-dkltnkubectl -n <appnamespace> describe ing <ingressname>kubectl describe ing test-ingress
``` Name: test-ingress Namespace: ldawert Address: 195.192.153.120 Default backend: default-http-backend:80 (What happened:
Trying to configure TLSv1.3 ciphers with:
The configuration made by the server-snippet is loaded correctly into the ingress controller pod into the server config block:
However when testing the TLS ciphers for example with
nmapit shows that still the default ciphers for TLSv1.3 are being used:What you expected to happen:
Setting
ssl_conf_command Ciphersuitesvianginx.ingress.kubernetes.io/server-snippetshould configure the used TLSv1.3 ciphers for the server block it is configured in.How to reproduce it:
create app
create ingress
``` $ cat ingress.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: annotations: nginx.ingress.kubernetes.io/ssl-ciphers: | 'ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384' nginx.ingress.kubernetes.io/server-snippet: | ssl_protocols TLSv1.2 TLSv1.3; ssl_conf_command Ciphersuites "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384"; kubernetes.io/ingress.class: nginx name: test-ingress spec: rules: - host: testdomain.local http: paths: - backend: service: name: nginx port: number: 80 path: / pathType: ImplementationSpecific $ kubectl apply -f ingress.yaml ```create debugging pod
``` $ cat netshoot.yaml apiVersion: v1 kind: Pod metadata: labels: run: tmp-shell name: tmp-shell spec: containers: - image: nicolaka/netshoot name: tmp-shell resources: {} command: - sleep - "100000" dnsPolicy: ClusterFirst restartPolicy: Always status: {} $ kubectl apply -f netshoot.yaml ```Get IP of ingress pod
Check ciphers in debugging pod
check ciphers
``` $ kubectl exec -ti tmp-shell -- bash bash-5.1$ echo "