Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Error generating self-signed certificate: could not create temp pem file /etc/ingress-controller/ssl/default-fake-certificate.pem #3589

Closed
4220182 opened this issue Dec 20, 2018 · 11 comments
Closed

Error generating self-signed certificate: could not create temp pem file /etc/ingress-controller/ssl/default-fake-certificate.pem #3589

4220182 opened this issue Dec 20, 2018 · 11 comments

Comments

@4220182
Copy link

4220182 commented Dec 20, 2018 

$ kubectl get po -n ingress-nginx
NAME                                        READY     STATUS             RESTARTS   AGE
nginx-ingress-controller-85df774dd4-clgp8   0/1       CrashLoopBackOff   1          11s

$ kubectl logs nginx-ingress-controller-85df774dd4-clgp8 -n ingress-nginx
-------------------------------------------------------------------------------
NGINX Ingress controller
  Release:    0.21.0
  Build:      b65b85cd9
  Repository: https://github.com/kubernetes/ingress-nginx
-------------------------------------------------------------------------------

W1220 13:48:40.371481       1 flags.go:209] SSL certificate chain completion is disabled (--enable-ssl-chain-completion=false)
nginx version: nginx/1.15.6
W1220 13:48:40.373794       1 client_config.go:548] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
I1220 13:48:40.374074       1 main.go:196] Creating API client for https://10.254.0.1:443
I1220 13:48:40.395039       1 main.go:240] Running in Kubernetes cluster version v1.9 (v1.9.11) - git (clean) commit 1bfeeb6f212135a22dc787b73e1980e5bccef13d - platform linux/amd64
F1220 13:48:40.658544       1 main.go:115] Error generating self-signed certificate: could not create temp pem file /etc/ingress-controller/ssl/default-fake-certificate.pem: open /etc/ingress-controller/ssl/default-fake-certificate.pem237497501: permission denied
@aledbf
Copy link
Member

aledbf commented Dec 20, 2018

@4220182 are you mounting a volume in /etc/ingress-controller/ssl/ or a parent directory?
Are you using a custom image?

@4220182
Copy link
Author

4220182 commented Dec 21, 2018

I made a mistake, I used a custom image,
I re-use quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.21.0 and there is no error.

thank‘s

@4220182 4220182 closed this as completed Dec 21, 2018
@anton-johansson anton-johansson mentioned this issue Mar 26, 2019
Closed
@JonsenDong
Copy link

I have the same problem. I used "quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.20.0"

@aledbf
Copy link
Member

aledbf commented Oct 22, 2019

@DONSEND you should not be using such a version due to all the NGINX CVEs. Please update to 0.26.1

@JonsenDong
Copy link

I will try,

@JonsenDong
Copy link

I solved my problem. Thank you.

@OryanOmer
Copy link

I solved my problem. Thank you.

How did you solve the problem?

@MartynRussell-Kcom
Copy link

This issue still affects me. @aledbf I just tried updating the image to 0.26.1, but it made no difference. I stumbled across #4061 and the most recent comment from @mcambal says:

"There is a breaking change in the default of runAsUser attribute due to migration to Alpine linux."

Is there a work around?

@aledbf
Copy link
Member

aledbf commented Jan 30, 2020

Is there a work around?

Update to 0.28.0 and make sure to update the deployment runAsUser: 33 to runAsUser: 101

@MartynRussell-Kcom
Copy link

Is there a work around?

Update to 0.28.0 and make sure to update the deployment runAsUser: 33 to runAsUser: 101

Worked perfectly with version 0.28.0.

I'll submit a bug report to ForgeRock about this for v6.5.2 (stable) release. Since it doesn't have the right version in there.

Thank you so much!

MartynRussell-Kcom pushed a commit to curlybeast/forgeops that referenced this issue Jan 30, 2020
@curlybeast
eks: Fixed ingress controller failing to create certs / CrashLoopBackOff
0512be4 
This is due to a bug in Kubernetes / Alpine Linux / Nginx controller and
user permissions. The fix is to use `--set controller.image.tag="0.28.0"`
in `eks-create-ingress-cntlr.sh`.

Issue was found using:

    $ kubectl -n nginx logs nginx-nginx-ingress-controller-7ff86667cb-clnnr
    -------------------------------------------------------------------------------
    NGINX Ingress controller
      Release:    0.21.0
      Build:      git-b65b85cd9
      Repository: https://github.com/aledbf/ingress-nginx
    -------------------------------------------------------------------------------

    I0130 10:59:19.037531       8 flags.go:176] Watching for Ingress class: nginx
    nginx version: nginx/1.15.6
    W0130 10:59:19.040927       8 client_config.go:548] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
    I0130 10:59:19.041146       8 main.go:196] Creating API client for https://10.100.0.1:443
    I0130 10:59:19.049909       8 main.go:240] Running in Kubernetes cluster version v1.14+ (v1.14.9-eks-c0eccc) - git (clean) commit c0eccca51d7500bb03b2f163dd8d534ffeb2f7a2 - platform linux/amd64
    I0130 10:59:19.054206       8 main.go:101] Validated nginx/nginx-nginx-ingress-default-backend as the default backend.
    F0130 10:59:19.213212       8 main.go:115] Error generating self-signed certificate: could not create temp pem file /etc/ingress-controller/ssl/default-fake-certificate.pem: open /etc/ingress-controller/ssl/default-fake-certificate.pem970979531: permission denied

This particular problem is quite common, see:
kubernetes/ingress-nginx#3589
MartynRussell-Kcom pushed a commit to curlybeast/forgeops that referenced this issue Feb 3, 2020
@curlybeast
eks: Fixed ingress controller failing to create certs / CrashLoopBackOff
dfbf2a9 
This is due to a bug in Kubernetes / Alpine Linux / Nginx controller and
user permissions. The fix is to use `--set controller.image.tag="0.28.0"`
in `eks-create-ingress-cntlr.sh`.

Issue was found using:

    $ kubectl -n nginx logs nginx-nginx-ingress-controller-7ff86667cb-clnnr
    -------------------------------------------------------------------------------
    NGINX Ingress controller
      Release:    0.21.0
      Build:      git-b65b85cd9
      Repository: https://github.com/aledbf/ingress-nginx
    -------------------------------------------------------------------------------

    I0130 10:59:19.037531       8 flags.go:176] Watching for Ingress class: nginx
    nginx version: nginx/1.15.6
    W0130 10:59:19.040927       8 client_config.go:548] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
    I0130 10:59:19.041146       8 main.go:196] Creating API client for https://10.100.0.1:443
    I0130 10:59:19.049909       8 main.go:240] Running in Kubernetes cluster version v1.14+ (v1.14.9-eks-c0eccc) - git (clean) commit c0eccca51d7500bb03b2f163dd8d534ffeb2f7a2 - platform linux/amd64
    I0130 10:59:19.054206       8 main.go:101] Validated nginx/nginx-nginx-ingress-default-backend as the default backend.
    F0130 10:59:19.213212       8 main.go:115] Error generating self-signed certificate: could not create temp pem file /etc/ingress-controller/ssl/default-fake-certificate.pem: open /etc/ingress-controller/ssl/default-fake-certificate.pem970979531: permission denied

This particular problem is quite common, see:
kubernetes/ingress-nginx#3589
MartynRussell-Kcom pushed a commit to curlybeast/forgeops that referenced this issue Feb 5, 2020
@curlybeast
eks: Fixed ingress controller failing to create certs / CrashLoopBackOff
420e003 
This is due to a bug in Kubernetes / Alpine Linux / Nginx controller and
user permissions. The fix is to use `--set controller.image.tag="0.28.0"`
in `eks-create-ingress-cntlr.sh`.

Issue was found using:

    $ kubectl -n nginx logs nginx-nginx-ingress-controller-7ff86667cb-clnnr
    -------------------------------------------------------------------------------
    NGINX Ingress controller
      Release:    0.21.0
      Build:      git-b65b85cd9
      Repository: https://github.com/aledbf/ingress-nginx
    -------------------------------------------------------------------------------

    I0130 10:59:19.037531       8 flags.go:176] Watching for Ingress class: nginx
    nginx version: nginx/1.15.6
    W0130 10:59:19.040927       8 client_config.go:548] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
    I0130 10:59:19.041146       8 main.go:196] Creating API client for https://10.100.0.1:443
    I0130 10:59:19.049909       8 main.go:240] Running in Kubernetes cluster version v1.14+ (v1.14.9-eks-c0eccc) - git (clean) commit c0eccca51d7500bb03b2f163dd8d534ffeb2f7a2 - platform linux/amd64
    I0130 10:59:19.054206       8 main.go:101] Validated nginx/nginx-nginx-ingress-default-backend as the default backend.
    F0130 10:59:19.213212       8 main.go:115] Error generating self-signed certificate: could not create temp pem file /etc/ingress-controller/ssl/default-fake-certificate.pem: open /etc/ingress-controller/ssl/default-fake-certificate.pem970979531: permission denied

This particular problem is quite common, see:
kubernetes/ingress-nginx#3589
MartynRussell-Kcom pushed a commit to curlybeast/forgeops that referenced this issue Feb 7, 2020
@curlybeast
eks: Fixed ingress controller failing to create certs / CrashLoopBackOff
b4e5c69 
This is due to a bug in Kubernetes / Alpine Linux / Nginx controller and
user permissions. The fix is to use `--set controller.image.tag="0.28.0"`
in `eks-create-ingress-cntlr.sh`.

Issue was found using:

    $ kubectl -n nginx logs nginx-nginx-ingress-controller-7ff86667cb-clnnr
    -------------------------------------------------------------------------------
    NGINX Ingress controller
      Release:    0.21.0
      Build:      git-b65b85cd9
      Repository: https://github.com/aledbf/ingress-nginx
    -------------------------------------------------------------------------------

    I0130 10:59:19.037531       8 flags.go:176] Watching for Ingress class: nginx
    nginx version: nginx/1.15.6
    W0130 10:59:19.040927       8 client_config.go:548] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
    I0130 10:59:19.041146       8 main.go:196] Creating API client for https://10.100.0.1:443
    I0130 10:59:19.049909       8 main.go:240] Running in Kubernetes cluster version v1.14+ (v1.14.9-eks-c0eccc) - git (clean) commit c0eccca51d7500bb03b2f163dd8d534ffeb2f7a2 - platform linux/amd64
    I0130 10:59:19.054206       8 main.go:101] Validated nginx/nginx-nginx-ingress-default-backend as the default backend.
    F0130 10:59:19.213212       8 main.go:115] Error generating self-signed certificate: could not create temp pem file /etc/ingress-controller/ssl/default-fake-certificate.pem: open /etc/ingress-controller/ssl/default-fake-certificate.pem970979531: permission denied

This particular problem is quite common, see:
kubernetes/ingress-nginx#3589
@jl178
Copy link

jl178 commented Jan 7, 2023

Just in case this helps someone else:

For anyone who has this permission error when using WSL2 and/or Rancher Desktop, I was able to resolve it by performing a Factory Reset for Rancher via the UI:
image

Note: This will reset all configurations.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@aledbf @4220182 @OryanOmer @JonsenDong @MartynRussell-Kcom @jl178