Add note for TLS settings on default rule #49233
Conversation
Alternative to make TLS work on the default rule or when faced with specific Subject Alternative Name requirements (e.g mandatory IPs instead of FQDN)
The committers listed above are authorized under a signed CLA. |
k8s-ci-robot
added
the
cncf-cla: no
|
Welcome @makhtardiouf! |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
size/S
✅ Pull request preview available for checkingBuilt without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify site configuration. |
| {{< note >}} | ||
| As an alternative to make TLS work on the default rule or when faced with specific | ||
| Subject Alternative Name requirements (e.g mandatory IPs instead of FQDN), user can update the | ||
| Ingress Controller to set as default certificate a custom Secret that satifies those requirements. | ||
|
|
||
| If using Nginx Ingress: | ||
|
|
||
| kubectl -n ingress-nginx edit deployment ingress-controller | ||
|
|
||
| Edit the args section as follows: | ||
|
|
||
| args: | ||
| - /nginx-ingress-controller | ||
| - '--publish-service=$(POD_NAMESPACE)/ingress-nginx-controller' | ||
| - '--default-ssl-certificate=default/testsecret-tls' | ||
| - ... | ||
| {{< /note >}} |
There was a problem hiding this comment.
This advice is specific to one ingress controller. We could add it as part of a blog article or a tutorial, but I don't think it's right for a page about the Ingress API as a concept.
There was a problem hiding this comment.
I would agree with that indeed
| - '--default-ssl-certificate=default/testsecret-tls' | ||
| - ... | ||
| {{< /note >}} | ||
|
|
||
| {{< note >}} |
There was a problem hiding this comment.
This note is useful, though - it's telling people to go and read the docs for the ingress controller(s) that they are actually using.
There was a problem hiding this comment.
The intent is to rectify or complete the note before it. See capture below.
I recently faced a mandatory mTLS requirement where the client calls an endpoint and checks if the certificate matches a given IP in the S.A.Ns.
- If the TLS cert is attached to an ingress resource, k8s will attempt to match it through the host rule (FQDN, as IPs won't work).
- If it doesn't match, k8s will fallback to the default "Fake Certificate", which the client needs to ignore in order to connect.
- The only solution is to create a TLS cert, with the required -ext SubjectAlternativeName:c=IP:x.x.x.x, and apply it as default cert for the ingress controller.
Alternative to make TLS work on the default rule or when faced with specific Subject Alternative Name requirements (e.g mandatory IPs instead of FQDN)
Description
Issue
Closes: #