Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

KIC fails to sync with Konnect when updating Certificate #4384

Closed
1 task done
czeslavo opened this issue Jul 21, 2023 · 0 comments · Fixed by #4400
Closed
1 task done

KIC fails to sync with Konnect when updating Certificate #4384

czeslavo opened this issue Jul 21, 2023 · 0 comments · Fixed by #4400
Assignees
Labels
area/konnect Issues and PRs related to Konnect bug Something isn't working
Milestone

Comments

@czeslavo
Copy link
Contributor

czeslavo commented Jul 21, 2023

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

When an existing Certificate generated out of a Kubernetes Secret gets updated, KIC fails to synchronise with Konnect's Runtime Group's Admin API with the following error:

time="2023-07-18T14:35:44Z" level=warning msg="Failed pushing configuration to Konnect" error="performing update for https://us.kic.api.konghq.com/kic/api/runtime_groups/5afc1090-6bc7-4b2a-a252-14f28fe1ac57 failed: 1 errors occurred:\n\twhile processing event: {Update} certificate 1fecb0e6-0674-43cd-8d1c-b4446fc23f90 failed: HTTP status 400 (message: \"proto: (line 1:5535): unknown field \\\"snis\\\"\")\n"

It's a result of a bug in deck that was already fixed in Kong/deck#978.

Expected Behavior

KIC succeeds to update existing certificates when syncing with Konnect's Runtime Group's Admin API.

Steps To Reproduce

1. Create an `Ingress` with `tls.[].secretName` pointing to a tls `Secret`.
2. Let KIC synchronise config with Gateways and Konnect (expect no errors).
3. Modify the `Secret`'s by replacing its key and crt with another valid pair. 

This will cause KIC to fail synchronise with the following error in logs:


time="2023-07-18T14:35:44Z" level=warning msg="Failed pushing configuration to Konnect" error="performing update for https://us.kic.api.konghq.com/kic/api/runtime_groups/5afc1090-6bc7-4b2a-a252-14f28fe1ac57 failed: 1 errors occurred:\n\twhile processing event: {Update} certificate 1fecb0e6-0674-43cd-8d1c-b4446fc23f90 failed: HTTP status 400 (message: \"proto: (line 1:5535): unknown field \\\"snis\\\"\")\n"

Kong Ingress Controller version

v2.10.3

Kubernetes version

No response

Anything else?

Although Kong/deck#978 is already merged in deck, it's not released yet. We need to wait for v1.24.0 to be released.

@czeslavo czeslavo added the bug Something isn't working label Jul 21, 2023
@czeslavo czeslavo modified the milestones: KIC v2.10.0, KIC v2.11.0 Jul 21, 2023
@czeslavo czeslavo mentioned this issue Jul 24, 2023
32 tasks
@pmalek pmalek added the area/konnect Issues and PRs related to Konnect label Jul 24, 2023
@czeslavo czeslavo assigned czeslavo and unassigned rainest Jul 25, 2023
czeslavo added a commit that referenced this issue Jul 25, 2023
czeslavo added a commit that referenced this issue Jul 25, 2023
czeslavo added a commit that referenced this issue Jul 25, 2023
czeslavo added a commit that referenced this issue Jul 25, 2023
Bumps deck to a version that fixes #4384 (in this particular commit). Propagates IsKonnect flag when creating diff.Syncer.
czeslavo added a commit that referenced this issue Jul 25, 2023
Bumps deck to a version that fixes #4384 (in this particular commit). Propagates IsKonnect flag when creating diff.Syncer.

(cherry picked from commit 4b8dc3e)
czeslavo added a commit that referenced this issue Jul 25, 2023
Bumps deck to a version that fixes #4384 (in this particular commit). Propagates IsKonnect flag when creating diff.Syncer.

(cherry picked from commit 4b8dc3e)
czeslavo added a commit that referenced this issue Jul 25, 2023
…4401)

Bumps deck to a version that fixes #4384 (in this particular commit). Propagates IsKonnect flag when creating diff.Syncer.

(cherry picked from commit 4b8dc3e)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/konnect Issues and PRs related to Konnect bug Something isn't working
Projects
None yet
3 participants