{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/2095","repository_url":"https://api.github.com/repos/kubernetes/ingress-nginx","labels_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/2095/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/2095/comments","events_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/2095/events","html_url":"https://github.com/kubernetes/ingress-nginx/issues/2095","id":297453609,"number":2095,"title":"nginx.ingress.kubernetes.io/auth-tls-secret breaks kube-lego","user":{"login":"farcaller","id":693,"avatar_url":"https://avatars2.githubusercontent.com/u/693?v=4","gravatar_id":"","url":"https://api.github.com/users/farcaller","html_url":"https://github.com/farcaller","followers_url":"https://api.github.com/users/farcaller/followers","following_url":"https://api.github.com/users/farcaller/following{/other_user}","gists_url":"https://api.github.com/users/farcaller/gists{/gist_id}","starred_url":"https://api.github.com/users/farcaller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/farcaller/subscriptions","organizations_url":"https://api.github.com/users/farcaller/orgs","repos_url":"https://api.github.com/users/farcaller/repos","events_url":"https://api.github.com/users/farcaller/events{/privacy}","received_events_url":"https://api.github.com/users/farcaller/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-02-15T13:54:01Z","updated_at":"2018-02-15T16:50:48Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"**What keywords did you search in NGINX Ingress controller issues before filing this one?** (If you have found any duplicates, you should instead reply there.): lego\r\n\r\n---\r\n\r\n**Is this a BUG REPORT or FEATURE REQUEST?** (choose one): BUG\r\n\r\n**NGINX Ingress controller version**:\r\n\r\n0.10.2\r\n\r\n**Kubernetes version** (use `kubectl version`):\r\n\r\n```\r\nClient Version: version.Info{Major:\"1\", Minor:\"9\", GitVersion:\"v1.9.0\", GitCommit:\"925c127ec6b946659ad0fd596fa959be43f0cc05\", GitTreeState:\"clean\", BuildDate:\"2017-12-16T03:15:38Z\", GoVersion:\"go1.9.2\", Compiler:\"gc\", Platform:\"darwin/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"9\", GitVersion:\"v1.9.0\", GitCommit:\"925c127ec6b946659ad0fd596fa959be43f0cc05\", GitTreeState:\"clean\", BuildDate:\"2017-12-15T20:55:30Z\", GoVersion:\"go1.9.2\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```\r\n\r\n**Environment**:\r\n\r\n- **Cloud provider or hardware configuration**: bare metal / kubeadm\r\n\r\n**What happened**:\r\n\r\nnginx ingress with `nginx.ingress.kubernetes.io/auth-tls-secret` prevents kube-lego from functioning\r\n\r\n**What you expected to happen**:\r\n\r\nnginx ingress works with kube-lego\r\n\r\n**How to reproduce it** (as minimally and precisely as possible):\r\n\r\nGiven an ingress that looks like\r\n\r\n```\r\napiVersion: extensions/v1beta1\r\nkind: Ingress\r\nmetadata:\r\n  annotations:\r\n    kubernetes.io/tls-acme: \"true\"\r\n    nginx.ingress.kubernetes.io/auth-tls-secret: ingress-nginx/clientcert\r\n  generation: 1\r\n  name: xxx\r\nspec:\r\n  rules:\r\n  - host: xxx.example.com\r\n    http:\r\n      paths:\r\n      - backend:\r\n          serviceName: xxx\r\n          servicePort: 80\r\n  tls:\r\n  - hosts:\r\n    - xxx.example.com\r\n    secretName: mysecret\r\n```\r\n\r\nI expect all the http to be redirected to https and https to require client cert.\r\n\r\nkube-lego installs its own ingress though, and that one must override the http redirect. As of now kube-lego's /.well-known path returns http 308 to a https url that returns 400.\r\n\r\n**Anything else we need to know**:\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/comments/365989451","html_url":"https://github.com/kubernetes/ingress-nginx/issues/2095#issuecomment-365989451","issue_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/2095","id":365989451,"user":{"login":"farcaller","id":693,"avatar_url":"https://avatars2.githubusercontent.com/u/693?v=4","gravatar_id":"","url":"https://api.github.com/users/farcaller","html_url":"https://github.com/farcaller","followers_url":"https://api.github.com/users/farcaller/followers","following_url":"https://api.github.com/users/farcaller/following{/other_user}","gists_url":"https://api.github.com/users/farcaller/gists{/gist_id}","starred_url":"https://api.github.com/users/farcaller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/farcaller/subscriptions","organizations_url":"https://api.github.com/users/farcaller/orgs","repos_url":"https://api.github.com/users/farcaller/repos","events_url":"https://api.github.com/users/farcaller/events{/privacy}","received_events_url":"https://api.github.com/users/farcaller/received_events","type":"User","site_admin":false},"created_at":"2018-02-15T16:50:48Z","updated_at":"2018-02-15T16:50:48Z","author_association":"CONTRIBUTOR","body":"@aledbf it's not a problem, nginx just shouldn't 308 the kube-lego ingress in the http server."}}
{"actor":{"display_login":"farcaller"}}