Multiple SNIs on a TLS certificate are not reflected in Kong certificate object about kubernetes-ingress-controller

[3dbrows]

Wow @hbagdi that was fast! 😄
I deployed #76 locally and it works great, thank you.

[hbagdi]

Hello @Dag24,
As documented, the ingress controller doesn't yet support Kong 0.14.0 for the reasons that you've posted above.

While I'm here, I'd also like to draw your attention to #94, which is another snag I encountered in TLS setup. Hopefully a trivial fix for that one, though. (Root CA certs are not installed in the ingress-controller or Kong Centos images.)

I'll look into this and post an update on #94 soon. Thanks!

[3dbrows]

A workaround is to manually add all the SNIs listed in spec.tls[0].hosts e.g.

curl -X POST \
    --url "kong-ingress-controller.kong.svc.cluster.local:8001/snis/" \
    --data "ssl_certificate_id=<certificate id>" \
    --data "name=bar.example.com"

Now requests to both https://foo.example.com and https://bar.example.com will succeed.

[hbagdi]

Hello @Dag24
I just opened up #76 to fix this issue.

Thank you for reporting this!

[3dbrows]

Hey @hbagdi I think we need to reopen this as it doesn't work with Kong 0.14.0. It does work with 0.13.1 and 0.13.0.

Using kong-0.13.1-centos: the logs of the ingress-controller container look like this (successful):

controller.go:127] syncing Ingress configuration...
kong.go:1008] creating Kong SSL Certificate for host foo.example.com located in Secret default/tls-secret
kong.go:1041] creating Kong SNI for host foo.example.com and certificate id 712398b9-a171-11e8-8806-0a58ac1f10d3
kong.go:1041] creating Kong SNI for host bar.example.com and certificate id 712398b9-a171-11e8-8806-0a58ac1f10d3

Using kong-0.14-centos:

controller.go:127] syncing Ingress configuration...
kong.go:1008] creating Kong SSL Certificate for host foo.example.com located in Secret default/tls-secret
kong.go:1028] updating certificate for host foo.example.com to certificate id 41e5ab7e-ef54-4be5-a859-35d1b51160ba
controller.go:130] unexpected failure updating Kong configuration: patching a Kong consumer: the server rejected our request for an unknown reason (patch snis.meta.k8s.io)
queue.go:113] requeuing dummy/dummy, err patching a Kong consumer: the server rejected our request for an unknown reason (patch snis.meta.k8s.io)
controller.go:127] syncing Ingress configuration...
kong.go:1008] creating Kong SSL Certificate for host foo.example.com located in Secret default/tls-secret
kong.go:1013] Unexpected error creating Kong Certificate: [400] {"fields":{"snis":"foo.example.com already associated with existing certificate '41e5ab7e-ef54-4be5-a859-35d1b51160ba'"},"name":"schema violation","code":2,"message":"schema violation (snis: foo.example.com already associated with existing certificate '41e5ab7e-ef54-4be5-a859-35d1b51160ba')"}

Of course, the important part here is the "schema violation" error. 0.14.0 contained a number of changes to the /snis and /certificates endpoints, which have probably triggered the above.

While I'm here, I'd also like to draw your attention to #94, which is another snag I encountered in TLS setup. Hopefully a trivial fix for that one, though. (Root CA certs are not installed in the ingress-controller or Kong Centos images.)