Operator doesn't take information of prefixes from Ingress configuration

[denis-buravlev]

Environment:
Pomerium chart: 15.0.0
Pomerium version: v0.12.1
Operator version: v0.0.5

I don't use Pomerium for routing. I use it only for forward auth (with Traefik).

Problem:

By some reasons I have an Ingress with the following configuration:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    ingress.pomerium.io/allowed_domains: '["example.com"]'
    ingress.pomerium.io/allowed_idp_claims: '{"groups":["group-name"]}'
  labels:
    ...
  name: ingress-rule-1
  namespace: default
spec:
  rules:
  - host: example.com
    http:
      paths:
      - backend:
          serviceName: example-service
          servicePort: 8080
        path: /path1
        pathType: ImplementationSpecific
      - backend:
          serviceName: example-service
          servicePort: 8080
        path: /path2
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - example.com
    secretName: secret-name

Operator generates the following policies:

- from: https://example.com
  to: http://example-service.default.svc.cluster.local:8080
  allowed_domains:
  - example.com
  allowed_idp_claims:
    groups:
    - group-name
- from: https://example.com
  to: http://example-service.default.svc.cluster.local:8080
  allowed_domains:
  - example.com
  allowed_idp_claims:
    groups:
    - group-name

Proxy service can't start with the configuration. It throws the following error:
ERR error applying configuration error="duplicate name policy-f7b2cb2f22d55930 found among added/updated resources" code=13 details=null

If I stop Operator and add "pathPrefix" options Proxy will start correctly.
From my point of view Operator should take pathPrefix information from Ingress rule.

Am I right?

[travisgroth]

Hi @denis-buravlev,

You're correct. This isn't supported currently, though I think it can be added.

[denis-buravlev]

Thanks a lot. It was a surprise for me because I'm using Pomerium since 0.9.x and Proxy didn't fall down before wit the same config.

[x0ddf]

Hi, this issue is still reproduced for pomerium 0.14.2 and operator version 0.0.5 on any k8s version 1.17+. Any chances what the issue will be fixed?

[travisgroth]

Closed by #143

This should be resolved by migrating to the Pomerium Ingress Controller (docs). See deprecation notice for more info.