Cannot Disable HTTP when using managed-certificates. Results in infinite Creating ingress and 'no frontend configuration'

[jakebolam]

Cannot Disable HTTP when using managed-certificates

When specifying the flag kubernetes.io/ingress.allow-http: "false" the ingress is never created, remains stuck in Creating ingress. Removing this annotation successfully completes the creation.

Versions

Kubernetes master/node-kube version: 1.12.6-gke.10

Additional Details:

The load balancer has the error This load balancer has no frontend configured
Hitting the HTTPS gateway results in unexpectedly closed the connection.
Hitting the HTTP gateway results in a google engine error page.

Configuration

apiVersion: networking.gke.io/v1beta1
kind: ManagedCertificate
metadata:
  name: api-certifcate
spec:
  domains:
    - example.com
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.allow-http: "false"
    kubernetes.io/ingress.global-static-ip-name: "web-static-ip"
    networking.gke.io/managed-certificates: api-certifcate
spec:
  rules:
    - http:
        paths:
          - path: /my-service/*
            backend:
              serviceName: my-service
              servicePort: 8080

[rramkumar1]

@jakebolam Thanks for filing the issue, this looks like a bug. The code [1] which decides whether to setup the HTTPS resources given the value of "allow-http" does not seem to take into account whether the user has configured SSL via Managed Certificates.

The fix should be straightforward and will be available in our next patch release.

[1] https://github.com/kubernetes/ingress-gce/blob/master/pkg/loadbalancers/l7.go#L138

/kind bug

[jakebolam]

@rramkumar1 no worries thanks for the fast response, the ingress has been performant and great for us, keep it up

[rramkumar1]

@jakebolam Actually now that the more I ponder this, the more I think this is WAI. Here the is reasoning:

Adding the "networking.gke.io/managed-certificates" annotation to your Ingress does not attach a cert to your Ingress. All its doing is displaying intent for a cert to be added. It's possible that the controller which reconciles ManagedCertificate resources fails to create the actual GCP cert, in which case no actual cert will be attached to your Ingress (via the "pre-shared-cert" annotation). Therefore, we (as in ingress-gce) can't setup HTTPS resources until we know that the cert you intended to be attached is actually attached. Otherwise, where will we get the cert from?

So, my recommendation would be to first verify that your Ingress is serving HTTPS and then set allow-http to "false".

Does this makes sense? I'm going to go ahead and close this out but feel free to reopen if you have more questions.

/close

[k8s-ci-robot]

@rramkumar1: Closing this issue.

Details

In response to this:

@jakebolam Actually now that the more I ponder this, the more I think this is WAI. Here the is reasoning:

Adding the "networking.gke.io/managed-certificates" annotation to your Ingress does not attach a cert to your Ingress. All its doing is displaying intent for a cert to be added. It's possible that the controller which reconciles ManagedCertificate resources fails to create the actual GCP cert, in which case no actual cert will be attached to your Ingress (via the "pre-shared-cert" annotation). Therefore, we (as in ingress-gce) can't setup HTTPS resources until we know that the cert you intended to be attached is actually attached. Otherwise, where will we get the cert from?

So, my recommendation would be to first verify that your Ingress is serving HTTPS and then set allow-http to "false".

Does this makes sense? I'm going to go ahead and close this out but feel free to reopen if you have more questions.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jakebolam]

Thanks for looking into this @rramkumar1. We've moved back to using pre-shared-certs for now.

Hopefully in the future Managed Certificates and the Ingress will be able to play nicer together.

[jakebolam]

@rramkumar1 GKE Manged Certs are working again and was unable to get HTTP to shut off. Created a new issue for this: #764