<p>I am struggling to get my nginx ingress (on AWS EKS) working with path rules and TLS.</p>
<p>The ingress is from
<a href="https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.44.0/deploy/static/provider/aws/deploy.yaml" rel="nofollow noreferrer">here</a></p>
<p>A snippet from the Ingress looks like:</p>
<pre><code>spec:
  tls:
  - hosts:
      - example.com
    secretName: ingress-tls
  rules:
  - host: example.com
  - http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 443
</code></pre>
<p>This ingress creates the AWS network load balancer, with a URL like
<code>https://xyz.elb.us-west-1.amazonaws.com/</code></p>
<p>I am updating the
<code>ingress-tls</code>
secret with a certificate using
<code>cert-manager</code>.</p>
<p>When I access the ingress using the NLB URL
<code>https://xyz.elb.us-west-1.amazonaws.com/api</code>, I get</p>
<ol>
<li>GOOD: Correct routing based on the path rules from the ingress definition (i.e. it ​goes to my
<code>api-service</code> as expected)</li>
<li>BAD: Certificate errors since I'm not accessing the ingress with the domain that the certificate is for.</li>
</ol>
<p>When I access the ingress using the correct domain e.g.
<code>https://example.com/api</code> which is what I want to do, I get:</p>
<ol>
<li>BAD:
<code>404</code>, it doesn't respect my path rules, and goes to
<code>upstream-default-backend</code> instead.</li>
<li>GOOD: certificate all good, it’s the one for
<code>example.com</code> that
<code>cert-manager</code> configured.</li>
</ol>
<p>I tried removing the
<code>host: example.com</code> from the
<code>rules:</code>, which gives me:</p>
<ol>
<li>GOOD: Correct routing based on the path rules from the ingress definition</li>
<li>BAD: Certificate errors, it serves up the default ingress “Fake” certificate instead of the one for
<code>example.com</code>, I guess since the
<code>host</code> is missing from the rules, though not sure of the exact reason.</li>
</ol>
<p>Can someone please help me get</p>
<ol>
<li>GOOD</li>
<li>GOOD</li>
</ol>
<p>I’m at a loss here.</p>

e.dan
<p>After staring at this for several more hours, and digging through the nasty chunk of lua that is the
<code>nginx.conf</code> for this, I found it!  Maybe someday someone will have this problem, and might find this useful.</p>
<p>The problem was:</p>
<pre><code>  rules:
  - host: example.com
  - http:
</code></pre>
<p>This is defining (I think) a
<code>host</code> with no forwarding rules, then then some
<code>http</code> forwarding rules without a host.  What I had intended was obviously that the forwarding rules would be for the host.</p>
<p>And that would be:</p>
<pre><code>  rules:
  - host: example.com
    http:
</code></pre>
<p>I have to say that I'm now even less of a fan of YAML than I was previously, if that's even possible.</p>
