Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Voyager Let's Encrypt fails when using HTTP-01 challenge with multiple domains #1385

Closed
drf opened this issue Apr 30, 2019 · 0 comments
Closed

Comments

@drf
Copy link
Contributor

drf commented Apr 30, 2019

Assume a similar scenario:

An ingress configured in a similar way:

apiVersion: voyager.appscode.com/v1beta1
kind: Ingress
metadata:
  name: my-ingress
spec:
  rules:
  - host: host1.example.com
    http:
      paths: [...]
  - host: host2.example.com
    http:
      paths: [...]

and an associated Certificate looking like this:

kind: Certificate
metadata:
  name: my-certificate
spec:
  acmeUserSecretName: voyager-acme-account
  challengeProvider:
    http:
      ingress:
        apiVersion: voyager.appscode.com/v1beta1
        kind: Ingress
        name: my-ingress
  domains:
  - host1.example.com
  - host2.example.com

This would trigger two http-01 challenges for both domains, and Voyager should handle both challenges separately for each separate hosts. Instead, Voyager creates this rule in the ingress:

Spec:
  Resources:
  Rules:
    Http:
      No TLS:     true
      Node Port:  0
      Paths:
        Backend:
          Service Name:  voyager-operator.kube-system
          Service Port:  56791
        Path:            /.well-known/acme-challenge/
      Port:              0

Which matches all hosts, and is served for both challenges. Moreover, the challenge reads neither the first nor the second, but only "TEST". Both challenges eventually fail.

Currently, http-01 is unusable if the Ingress is exposing more than one host at a time.

Expected behaviour: Voyager should create one rule per host, and provide the challenge on a per-host basis.

@drf drf closed this as completed May 1, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant