<p>I'm trying to setup and expose a service (ArgoCD) to outside a cluster. Note: I'm fairly new to Kubernetes, so quite probably I have some misconceptions. If you can see one, please help me get rid of it. If more information is needed to diagnose what's happening, please let me know, I'll add it.</p>
<p>I have nginx-ingress ingress controller installed in the cluster in the namespace <code>nginx</code>. I have installed ArgoCD via helm into <code>argocd</code> namespace*. <code>kubectl get service -n argocd</code> shows (omitting AGE column):</p>
<pre><code>NAME                                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)
projectname-argocd-application-controller   ClusterIP   10.100.249.133   &lt;none&gt;        8082/TCP
projectname-argocd-dex-server               ClusterIP   10.100.80.187    &lt;none&gt;        5556/TCP,5557/TCP
projectname-argocd-redis                    ClusterIP   10.100.230.170   &lt;none&gt;        6379/TCP
projectname-argocd-repo-server              ClusterIP   10.100.221.87    &lt;none&gt;        8081/TCP
projectname-argocd-server                   ClusterIP   10.100.22.26     &lt;none&gt;        80/TCP,443/TCP
</code></pre>
<p>As far as I understand, service <code>projectname-argocd-server</code> is the one I should expose to get ArgoCD WebUI. Trying to do so, I've created an ingress (based on <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#resource-backend" rel="nofollow noreferrer">docs</a>):</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-routing

spec:
  rules:
  - host: test2.projectname.org
    http:
      paths:
      - path: /
        pathType: Prefix # presumably may comment this out
        backend:
          service:
            name: projectname-argocd-server
            port:
              number: 80
  # this was added later while trying to figure the problem out
  defaultBackend:
    service:
      name: projectname-argocd-server
      port:
        number: 80
  ingressClassName: nginx
</code></pre>
<p>and applied it via <code>kubectl apply -f routing.yaml -n argocd</code>. Now I can see the ingress is created along with the one created by deployment of ArgoCD, and the output of <code>kubectl get ing -A</code> is (omitting AGE, and PORTS that are 80; <code>&lt;url&gt;</code> is url of LoadBalancer shown in AWS console):</p>
<pre><code>NAMESPACE   NAME                        CLASS    HOSTS                   ADDRESS
argocd      projectname-argocd-server   nginx    test.projectname.org    &lt;url&gt;
argocd      ingress-routing             nginx    test2.projectname.org   &lt;url&gt;
</code></pre>
<p>By the way, <code>kubectl get svc -n nginx</code> shows that <code>nginx-ingress-ingress-nginx-controller</code> is LoadBalancer with url <code>&lt;url&gt;</code> (<code>80:30538/TCP</code>).</p>
<p><code>kubectl describe ingress -n argocd</code> shows that ingress <code>ingress-routing</code> is ok, with correct address, default backend and rules; for ingress <code>projectname-argocd-server</code> it shows ok address and rules (path <code>/</code>), although <code>Default backend</code> is shown as <code>default-http-backend:80 (&lt;error: endpoints &quot;default-http-backend&quot; not found&gt;)</code>.</p>
<p>Now let me also show the DNS settings to complete the picture:</p>
<ul>
<li>I've created a hosted zone for projectname.org (in Route 53), put its DNS servers to NS-entries of domain register</li>
<li>I've created a CNAME entry in the hosted zone, pointing <code>test.projectname.org</code> to <code>&lt;url&gt;</code></li>
<li>I've created an A entry for <code>test2.projectname.org</code>, selected the load balancer from the list and so it points to <code>dualstack.&lt;url&gt;</code></li>
</ul>
<p><strong>I expected</strong> to see ArgoCD interface at least at one of <code>http://test.projectname.org/</code> and <code>http://test2.projectname.org/</code>. What <strong>actually happens</strong> is:</p>
<ol>
<li><p>when I open <code>http://test.projectname.org/</code>, it redirects me to https url and shows <code>NET::ERR_CERT_AUTHORITY_INVALID</code>. If I insist on visiting, browser shows <code>ERR_TOO_MANY_REDIRECTS</code>.</p>
</li>
<li><p>Before I added ingress class and moved <code>ingress-routing</code> from <code>nginx</code> namespace to <code>argocd</code> namespace, <code>http://test2.projectname.org/</code> gave me 404; now it also redirects to https and then gives <code>ERR_TOO_MANY_REDIRECTS</code></p>
</li>
<li><p>I've also checked the <code>/healthz</code> addresses but they give the same result as the <code>/</code> ones. (in contrast, <code>http://&lt;url&gt;/healthz</code> gives an empty page)</p>
</li>
</ol>
<p><strong>My question is: what else am I missing, why I don't get the UI?</strong></p>
<p>Is it impossible to expose a service before setting some SSL certificate? Can 2 ingresses conflict when trying to expose the same thing on different subdomains (test.projectname.org and test2.projectname.org)? <strong>Can I see at least one service (ArgoCD) without using projectname.org to check if it is configured and deployed properly?</strong> (to separate if it's an ingress/routing/dns issue or a configuration issue)</p>
<p>(*) Here's the chart that I used to install ArgoCD:</p>
<pre><code>apiVersion: v2
name: argo-cd
appVersion: v2.1.5
description: A declarative, GitOps continuous delivery tool for Kubernetes
version: 3.26.3

dependencies:
  - name: argo-cd
    version: 3.26.3
    repository: https://argoproj.github.io/argo-helm
</code></pre>
<p>and values-overwrite.yaml that I've used is just <a href="https://github.com/argoproj/argo-helm/blob/master/charts/argo-cd/values.yaml" rel="nofollow noreferrer">default values</a> wrapped into <code>argo-cd:</code> thing since these should be applied to the dependency. Notably, those have <code>enabled: false</code> in <code>ingress:</code>, so the fact that ingress <code>projectname-argocd-server</code> is created is somewhat unexpected.</p>
<p>PS the <code>nginx</code> IngressClass was generated, not created manually, so it may be useful to see it as well (I've substituted ids and timestamps with &quot;...&quot;), as shown by <code>kubectl get IngressClass nginx -o yaml</code>:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  annotations:
    meta.helm.sh/release-name: nginx-ingress
    meta.helm.sh/release-namespace: nginx
  creationTimestamp: ...
  generation: 1
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: nginx-ingress
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/version: 1.0.3
    helm.sh/chart: ingress-nginx-4.0.5
  name: nginx
  resourceVersion: &quot;5750&quot;
  uid: ...
spec:
  controller: k8s.io/ingress-nginx
</code></pre>

<p>Right, the issue was somewhat complicated, but I've figured it out. Basically, it consists of 2 problems:</p>
<ol>
<li>https configuration and</li>
<li>ingress configuration</li>
</ol>
<p>The main problem about https configuration was solved in a separate <a href="https://stackoverflow.com/q/69964611/3995261">question</a> and is reduced to switching ACME server from staging to production. I've provided more details it in my answer.</p>
<p>Now, the ingress configuration is somewhat tricky since ArgoCD has some redirections, ~inner TLS requirements~, and also serves more than one protocol at :443. Fortunately, I've found <a href="https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#kubernetesingress-nginx" rel="nofollow noreferrer">this tutorial</a> which shows ssl-passthrough settings, more ingress annotations, including <code>nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;</code> which fixes the <code>ERR_TOO_MANY_REDIRECTS</code> error. Here's my ingress config which works fine with https set up (note also changes in port and tls secret):</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-argocd-routing
  namespace: argocd
  annotations:
    cert-manager.io/cluster-issuer: &lt;cluster issuer name&gt;
    kubernetes.io/tls-acme: &quot;true&quot;
    nginx.ingress.kubernetes.io/ssl-passthrough: &quot;true&quot;
    nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
spec:
  ingressClassName: nginx
  tls:
    - hosts:
      - test2.projectname.org # switched to argocd. later
      secretName: argocd-secret # do not change, this is provided by Argo CD
  rules:
    - host: test2.projectname.org # switched to argocd. later
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: projectname-argocd-server
                port:
                  number: 443
</code></pre>
