k8s nginx 入口 TLS 规则：证书与路径

Question

I am struggling to get my nginx ingress (on AWS EKS) working with path rules and TLS.

The ingress is from here

A snippet from the Ingress looks like:

spec:
  tls:
  - hosts:
      - example.com
    secretName: ingress-tls
  rules:
  - host: example.com
  - http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 443

This ingress creates the AWS network load balancer, with a URL like https://xyz.elb.us-west-1.amazonaws.com/

I am updating the ingress-tls secret with a certificate using cert-manager .

When I access the ingress using the NLB URL https://xyz.elb.us-west-1.amazonaws.com/api , I get

1. GOOD: Correct routing based on the path rules from the ingress definition (ie it goes to my api-service as expected)
2. BAD: Certificate errors since I'm not accessing the ingress with the domain that the certificate is for.

When I access the ingress using the correct domain eg https://example.com/api which is what I want to do, I get:

1. BAD: 404 , it doesn't respect my path rules, and goes to upstream-default-backend instead.
2. GOOD: certificate all good, it's the one for example.com that cert-manager configured.

I tried removing the host: example.com from the rules: , which gives me:

1. GOOD: Correct routing based on the path rules from the ingress definition
2. BAD: Certificate errors, it serves up the default ingress “Fake” certificate instead of the one for example.com , I guess since the host is missing from the rules, though not sure of the exact reason.

Can someone please help me get

1. GOOD
2. GOOD

I'm at a loss here.

Answer 1

After staring at this for several more hours, and digging through the nasty chunk of lua that is the nginx.conf for this, I found it, Maybe someday someone will have this problem. and might find this useful.

The problem was:

  rules:
  - host: example.com
  - http:

This is defining (I think) a host with no forwarding rules, then then some http forwarding rules without a host. What I had intended was obviously that the forwarding rules would be for the host.

And that would be:

  rules:
  - host: example.com
    http:

I have to say that I'm now even less of a fan of YAML than I was previously, if that's even possible.