Missing SSL certificate roots

[3dbrows]

The following error can be seen in the ingress-controller container logs every minute when you have an Ingress definition using a TLS secret (in my case a cert from Let's Encrypt):

backend_ssl.go:153] unexpected error generating SSL certificate with full intermediate chain CA certs: x509: failed to load system roots and no roots provided

The line of code in question is this one.

This is because the Debian base image used by the ingress-controller image doesn't ship with root CA certs, so it can't verify the full chain.

We can work around this by starting the ingress-controller container with a command like:

sh -c apt-get update && apt-get install -y ca-certificates && /kong-ingress-controller <options...>

But it would probably be nicer to do something like this in the Dockerfile:

apt-get update && apt-get install -y ca-certificates

I am using the Kong Ingress controller snis-fix branch.

A similar fix might be needed in the kong:0.X-centos7 Dockerfiles, by the way, but not the Alpine ones, because they already include apk add ca-certificates.

[hbagdi]

Hi @Dag24,

Thank you for reporting this issue.
I've opened up #95, which should fix this issue.

[3dbrows]

This is fixed in 0.1.0, thank you!