sync error regression in 1.5.1

[pdeva]

We recently upgraded our GKE cluster 1.12.6-gke.7 (and subsequently to 1.12.6-gke.10) and started noticing this error in the ingress:

Error during sync: error running load balancer syncing routine: resource name may not be empty

While the ingress is still functioning, this messages keep appearing.
it seems be some regression in 1.5.1 which was introduced in 1.12.6-gke.7

[rramkumar1]

@pdeva Can you please send me an email with your project name, cluster name and cluster location?

[pdeva]

@rramkumar1 done.

[rramkumar1]

Had an offline discussion with @pdeva. Here is what we found:

1. In 1.12.6-gke.7 (Ingress-GCE v1.5.1), we introduced logic to accept both preshared certs and secrets specified in the "tls" field. We previously did not process secrets if you had the preshared cert annotation, but upon upgrade to this version, we now did.

2. The Ingress being used specified both pre-shared certs and hosts in the "tls" field. Note that it did not specify "secretName". The user was under the impression that we respect the hosts you provide in the "tls" field, but we don't. Since we reconcile GCP SSLCertificate objects, the hosts you specify in your cert are the ones that are respected.

3. The combination of 1 and 2 meant that we tried to fetch the secret because we were now capable of it but since "secretName" was empty, the resulting error occured. The workaround was to simply delete whatever was specified under the "tls" field since it was not being used anyway.

Couple action items for myself before this issue is closed:

• Add documentation for this new capability of specifying both preshared certs and secrets.
• Add documentation that we do not respect what you put under the "hosts" field.
• Submit a fix in our next patch release that ensures we do not attempt to fetch a secret if the name is not provided.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[bowei]

/lifecycle frozen

[rramkumar1]

All AIs have been address here.