<p>Please help ..</p>
<p>I am building nginx plus ingress controller and deplyoing in eks using Dockerfile</p>
<pre><code>
Dockerfile:

FROM amazonlinux:2

LABEL maintainer=&quot;armand@f5.com&quot;

ENV NGINX_VERSION 23
ENV NJS_VERSION   0.5.2
ENV PKG_RELEASE   1.amzn2.ngx
ENV PATH=&quot;/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH}&quot;
RUN mkdir -p /etc/ssl/nginx
ADD nginx-repo.crt /etc/ssl/nginx
ADD nginx-repo.key /etc/ssl/nginx
ADD qlik.crt /etc/ssl/nginx
RUN update-ca-trust extract
RUN yum -y update  \
    &amp;&amp; yum -y install sudo
RUN set -x \
    &amp;&amp; chmod 644 /etc/ssl/nginx/* \
    &amp;&amp; yum install -y --setopt=tsflags=nodocs wget ca-certificates bind-utils wget bind-utils vim-minimal shadow-utils \
    &amp;&amp; groupadd --system --gid 101 nginx \
    &amp;&amp; adduser -g nginx --system --no-create-home --home /nonexistent --shell /bin/false --uid 101 nginx \
    &amp;&amp; usermod -s /sbin/nologin nginx \
    &amp;&amp; usermod -L nginx \
    &amp;&amp; wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/nginx-plus-amazon2.repo \
    &amp;&amp; yum --showduplicates list nginx-plus \
    &amp;&amp; yum install -y --setopt=tsflags=nodocs nginx-plus-${NGINX_VERSION}-${PKG_RELEASE} \
    &amp;&amp; rm /etc/nginx/conf.d/default.conf \
    &amp;&amp; mkdir -p /var/cache/nginx \
    &amp;&amp; mkdir -p /var/lib/nginx/state \
    &amp;&amp; chown -R nginx:nginx /etc/nginx \
    &amp;&amp; ln -sf /dev/stdout /var/log/nginx/access.log \
    &amp;&amp; ln -sf /dev/stderr /var/log/nginx/error.log \
    &amp;&amp; ulimit -c -m -s -t unlimited \
    &amp;&amp; yum clean all \
    &amp;&amp; rm -rf /var/cache/yum \
    &amp;&amp; rm -rf /etc/yum.repos.d/* \
    &amp;&amp; rm /etc/ssl/nginx/nginx-repo.crt /etc/ssl/nginx/nginx-repo.key


RUN echo &quot;root:root&quot; | chpasswd

EXPOSE 80 443 8080
STOPSIGNAL SIGTERM
CMD [&quot;nginx&quot;, &quot;-g&quot;, &quot;daemon off;&quot;]

</code></pre>
<p>I am starting the container using helm commands</p>
<pre><code>
            helm upgrade \
              --install my-athlon-ingress-controller nginx-stable/nginx-ingress --version 0.11.3 --debug \
              --set controller.image.pullPolicy=Always \
              --set controller.image.tag=6.0.1 \
              --set controller.image.repository=957123096554.dkr.ecr.eu-central-1.amazonaws.com/nginx-service \
              --set controller.nginxplus=true \
              --set controller.enableSnippets=true \
              --set controller.enablePreviewPolicies=true \
              --set-string controller.service.annotations.'service\.beta\.kubernetes\.io/aws-load-balancer-type'='nlb' \
              --set-string controller.service.annotations.'service\.beta\.kubernetes\.io/aws-load-balancer-backend-protocol'='tcp' \
              --set-string controller.service.annotations.'service\.beta\.kubernetes\.io/aws-load-balancer-proxy-protocol'='*' \
              --set-string controller.service.annotations.'service\.beta\.kubernetes\.io/aws-load-balancer-ssl-ports'='443'
            echo Setting up SSL
            export tlskey=$(aws secretsmanager get-secret-value --secret-id myathlon/infrastructure/$(env)/gate-key |jq --raw-output '.SecretString' )
            echo $tlskey
            export tlscrt=$(aws secretsmanager get-secret-value --secret-id myathlon/infrastructure/$(env)/gate-crt |jq --raw-output '.SecretString' )
            echo $tlscrt
            helm upgrade --install nginx-certificate-secrets ./helm-chart-nginx-certificates --set tlscrt=$tlscrt --set tlskey=$tlskey

</code></pre>
<p>Ok, let me give more clarity , i have a nginx pod running in debian 10 and when i try to curl a particular endpoint in keycloak i get a error like</p>
<p>2022/06/13 12:17:46 [info] 35#35: *35461 invalid JWK set while sending to client, client: 141.113.3.32, server: gate-acc.athlon.com, request:</p>
<p>but when i curl the same end point from a application (java pod) i get a response 200 .</p>
<p>Both nginx pod and all my application pod is in same namespace and the from the same cluster in EKS.</p>
<p>the difference i see between nginx pod and application pod is  application pod i used the base image as amazon linux but the ngnix pod is with the base image of debian .</p>
<p>so i suspect the OS is the issue , so now i try to build a ngnix plus image using amazon linux and deploy using helm and then try to curl the keycloak end point , that is when i get this PATH not found issue ,</p>
<p>I assume amazon linux may have some root certificate already trusted inbuild so it is able to curl my keycloak but debian does not .</p>
<p>This is the reason i am doing this , adding a certificate in the docker file is a interim solution , if this works then i can add this as secrets and mount as file system .</p>
<p>Both the ngnix pod build in amazon linux or debian as only nginx user , i am not able to login as root , so i am not able to install any utilities like tcpdump or MRT or dig to see what is happening when i do curl , the strange thing is not even ps , sudo or any basis command is working as i dont have root , i am not even able to install anything .</p>
<p>Error :</p>
<p>Error: failed to start container &quot;my-athlon-ingress-controller-nginx-ingress&quot;: Error response from daemon: OCI runtime create failed: container_linux.go:380: starting container process caused: exec: &quot;-nginx-plus=true&quot;: executable file not found in $PATH: unknown</p>
<p>My goal is deploy this image and have the root certifcate installed in amazon linux machine and have root access for the pod .</p>
<p>I am getting the above message any help is much appreciated , i also added ENV path in my docker file .</p>
<p>qlik.crt has the root certificate</p>
<p>Please help, thanks</p>

Dilu
<p>For loading certificates you need not to build the nginx docker image. You can use secrets to load the same as volume mount to deployment/daemon set configuration.</p>
