mitchdraft
commented
5 years ago How to repro on GlooE v0.19.0 (cannot repro on Gloo)
Create the secret:
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=animalstore.example.com"
kubectl create secret tls gloo.solo.io --key tls.key --cert tls.crt --namespace gloo-systemApply the following virtual services
- note that two virtual services have equivalent sslConfigs, which produces this error:
multiple filter chains with overlapping matching rules are defined
apiVersion: v1
items:
- apiVersion: gateway.solo.io/v1
kind: VirtualService
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"gateway.solo.io/v1","kind":"VirtualService","metadata":{"annotations":{},"name":"docsmgmt-http","namespace":"default"},"spec":{"virtualHost":{"domains":["test.com"],"routes":[{"matcher":{"prefix":"/"},"redirectAction":{"hostRedirect":"docs.solo.io","httpsRedirect":true}}]}}}
creationTimestamp: "2019-10-28T19:28:36Z"
generation: 1
name: docsmgmt-http
namespace: default
resourceVersion: "13475945"
selfLink: /apis/gateway.solo.io/v1/namespaces/default/virtualservices/docsmgmt-http
uid: 23497fb0-f9b9-11e9-8605-42010a800159
spec:
virtualHost:
domains:
- test.com
routes:
- matcher:
prefix: /
redirectAction:
hostRedirect: docs.solo.io
httpsRedirect: true
status:
reported_by: gateway
state: 1
- apiVersion: gateway.solo.io/v1
kind: VirtualService
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"gateway.solo.io/v1","kind":"VirtualService","metadata":{"annotations":{},"name":"docsmgmt1","namespace":"default"},"spec":{"sslConfig":{"secretRef":{"name":"gloo.solo.io","namespace":"gloo-system"},"sniDomains":["gloo.solo.io"]},"virtualHost":{"domains":["abc.com"],"routes":[{"matcher":{"prefix":"/"},"redirectAction":{"hostRedirect":"solo.io"}}]}}}
creationTimestamp: "2019-10-28T19:28:36Z"
generation: 1
name: docsmgmt1
namespace: default
resourceVersion: "13475946"
selfLink: /apis/gateway.solo.io/v1/namespaces/default/virtualservices/docsmgmt1
uid: 2318f146-f9b9-11e9-8605-42010a800159
spec:
sslConfig:
secretRef:
name: gloo.solo.io
namespace: gloo-system
sniDomains:
- gloo.solo.io
virtualHost:
domains:
- abc.com
routes:
- matcher:
prefix: /
redirectAction:
hostRedirect: solo.io
status:
reported_by: gateway
state: 1
- apiVersion: gateway.solo.io/v1
kind: VirtualService
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"gateway.solo.io/v1","kind":"VirtualService","metadata":{"annotations":{},"name":"docsmgmt2","namespace":"default"},"spec":{"sslConfig":{"secretRef":{"name":"gloo.solo.io","namespace":"gloo-system"},"sniDomains":["gloo.solo.io"]},"virtualHost":{"domains":["123.com"],"routes":[{"matcher":{"prefix":"/"},"redirectAction":{"hostRedirect":"solo.io"}}]}}}
creationTimestamp: "2019-10-28T19:28:36Z"
generation: 1
name: docsmgmt2
namespace: default
resourceVersion: "13475947"
selfLink: /apis/gateway.solo.io/v1/namespaces/default/virtualservices/docsmgmt2
uid: 2330bba0-f9b9-11e9-8605-42010a800159
spec:
sslConfig:
secretRef:
name: gloo.solo.io
namespace: gloo-system
sniDomains:
- gloo.solo.io
virtualHost:
domains:
- 123.com
routes:
- matcher:
prefix: /
redirectAction:
hostRedirect: solo.io
status:
reported_by: gateway
state: 1
kind: List
metadata:
resourceVersion: ""
selfLink: ""Here is a more terse form of the virtual services (Equivalent to the above):
apiVersion: gateway.solo.io/v1
kind: VirtualService
metadata:
annotations:
name: docsmgmt1
spec:
sslConfig:
secretRef:
name: gloo.solo.io
namespace: gloo-system
sniDomains:
- gloo.solo.io
virtualHost:
domains:
- "abc.com"
routes:
- matcher:
prefix: /
redirectAction:
hostRedirect: twitter.com
---
apiVersion: gateway.solo.io/v1
kind: VirtualService
metadata:
annotations:
name: docsmgmt2
spec:
sslConfig:
secretRef:
name: gloo.solo.io
namespace: gloo-system
sniDomains:
- gloo.solo.io
virtualHost:
domains:
- "123.com"
routes:
- matcher:
prefix: /
redirectAction:
hostRedirect: github.com
---
apiVersion: gateway.solo.io/v1
kind: VirtualService
metadata:
name: docsmgmt-http
spec:
virtualHost:
domains:
- "test.com"
routes:
- matcher:
prefix: /
redirectAction:
hostRedirect: google.com
httpsRedirect: true
github-actions[bot]
DuncanDoyle
logs during a crash:
I believe this was caused by the following bad config:
expands to this:
after I deleted the sslConfig, this error went away (that identical sslConfig was used in a different virtual service)
we should be able to perform this validation before submitting to Envoy