<p>I have deployed an ingress in Kubernetes and using two applications on different ingress namespaces.</p>
<p>When I access the APP2 I can reach the website and it's working fine but APP1 is displaying BLANK page. No errors just BLANK and response 200 OK.</p>
<p>Basically I integrated ArgoCd with Azure AD. The integration it is fine but I think ingress rules are not totally fine.</p>
<p>Both Apps are on different namespaces so I have to use two different ingress on different namespaces:</p>
<p>This is the APP1:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-server-ingress
  namespace: argocd
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/rewrite-target: /argo-cd/$2
    nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
    nginx.ingress.kubernetes.io/ssl-passthrough: &quot;true&quot;
    nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
spec:
  defaultBackend:
    service:
      name: argocd-server
      port:
        number: 443
  rules:
  - http:
      paths:
        - path: /argo-cd
          pathType: Prefix
          backend:
            service:
              name: argocd-server
              port:
                number: 443
</code></pre>
<p>And this is the APP2:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: sonarqube-ingress
  namespace: ingress-nginx
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
    nginx.ingress.kubernetes.io/use-regex: &quot;true&quot;
    nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  defaultBackend:
    service:
      name: sonarqube
      port:
        number: 9000  
  tls:
  - hosts:
    - sq-example
    secretName: nginx-cert
  rules:
  - host: sq.example.com
    http:
      paths:
      - path: /sonarqube(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: sonarqube
            port:
              number: 9000
      - path: /(.*)
        pathType: Prefix
        backend:
          service:
            name: sonarqube
            port:
              number: 9000
</code></pre>
<p>args of ingress deployment:</p>
<pre><code>spec:
      containers:
      - args:
        - /nginx-ingress-controller
        - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
        - --election-id=ingress-controller-leader
        - --controller-class=k8s.io/ingress-nginx
        - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
        - --validating-webhook=:8443
        - --validating-webhook-certificate=/usr/local/certificates/cert
        - --validating-webhook-key=/usr/local/certificates/key
        - --default-ssl-certificate=ingress-nginx/ca-key-pair
        - --enable-ssl-passthrough
</code></pre>
<p>logs ingress controller pod:</p>
<pre><code>10.200.140.160 - - [03/Nov/2021:15:00:34 +0000] &quot;GET /argo-cd HTTP/1.1&quot; 200 831 &quot;-&quot; &quot;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36&quot; 489 0.002 [argocd-argocd-server-443] [] 10.200.140.177:8080, 10.200.140.177:8080 0, 831 0.000, 0.004 502, 200 d491c01cd741fa9f155642f8616b6d9f
2021/11/03 15:09:05 [error] 867#867: *534643 SSL_do_handshake() failed (SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number) while SSL handshaking to upstream, client: 10.200.140.160, server: _, request: &quot;GET /argo-cd/ HTTP/1.1&quot;, upstream: &quot;https://10.200.140.177:8080/argo-cd/&quot;, host: &quot;10.200.140.211&quot;
10.200.140.160 - - [03/Nov/2021:15:09:05 +0000] &quot;GET /argo-cd/ HTTP/1.1&quot; 200 831 &quot;-&quot; &quot;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36&quot; 440 0.006 [argocd-argocd-server-443] [] 10.200.140.177:8080, 10.200.140.177:8080 0, 831 0.000, 0.004 502, 200 8995b914ae6e39d8ca781e1f4f269f50
10.200.140.160 - - [03/Nov/2021:15:09:16 +0000] &quot;GET /argo-cd HTTP/1.1&quot; 200 831 &quot;-&quot; &quot;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36&quot; 489 0.001 [argocd-argocd-server-443] [] 10.200.140.177:8080 831 0.004 200 0adadba11c87f9b88ed75d52e4ca387a
</code></pre>
<p>I tryied playing with the path: /argo-cd on APP1 like:</p>
<p>path: /argo-cd/
path: /argo-cd/(/|$)(.<em>)
path: /argo-cd/(.</em>)
path: /argo-cd/*</p>
<p>but impossible to make it work. Am I doing something wrong here?</p>
<p>Thanks in advance.</p>

X T
<p>The problem is that you didn't configure the argo-cd root path.</p>
<hr />
<p><em>Why?</em></p>
<p>First, it's worth to remind that NGINX Ingress controller <a href="https://docs.nginx.com/nginx-ingress-controller/installation/running-multiple-ingress-controllers/#running-multiple-nginx-ingress-controllers" rel="nofollow noreferrer">by default is <em>Cluster-wide</em></a>:</p>
<blockquote>
<ul>
<li><strong>Cluster-wide Ingress Controller (default)</strong>. The Ingress Controller handles configuration resources created in any namespace of the cluster. As NGINX is a high-performance load balancer capable of serving many applications at the same time, this option is used by default in our installation manifests and Helm chart.</li>
</ul>
</blockquote>
<p>So even if you have configured Ingresses in different namespaces at the end you are using the same NGINX Ingress Controller. You can check it by running:</p>
<pre><code>kubectl get ing -n ingress-nginx
kubectl get ing -n argocd
</code></pre>
<p>You can observe that <code>ADDRESS</code> is the same for both ingresses in different namespaces.</p>
<p>Let's assume that I have applied only the first ingress definition (APP1). If I try to reach <code>https://{ingress-ip}/argo-cd</code> I will be redirected to the <code>https://{ingress-ip}/applications</code> website - it works probably because you also setup the  <code>defaultBackend</code> setting. Anyway it's not a good approach - you should configure the argo-cd root path correctly.</p>
<p>When I applied the second ingress definition (APP2) I'm also getting the blank page as you - probably because the definitions from both ingresses are mixing and this is causing an issue.</p>
<p><em>How to setup the argo-cd root path?</em></p>
<p>Based on <a href="https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-2-mapping-crd-for-path-based-routing" rel="nofollow noreferrer">this documentation</a>:</p>
<blockquote>
<p>Edit the <code>argocd-server</code> deployment to add the <code>--rootpath=/argo-cd</code> flag to the argocd-server command.</p>
</blockquote>
<p>It's not really explained in detailed way in the docs, but I figured how to setup it:</p>
<p>First, we need to get current deployment configuration:</p>
<pre><code>kubectl get deploy argocd-server -o yaml -n argocd &gt; argocd-server-deployment.yaml
</code></pre>
<p>Now, we need to edit the <code>argocd-server-deployment.yaml</code> file. Under <code>command</code> (in my case it was line 52) we need to add <code>rootpath</code> flag - before:</p>
<pre><code>containers:
- command:
  - argocd-server
  env:
</code></pre>
<p>After:</p>
<pre><code>containers:
- command:
  - argocd-server
  - --rootpath=/argo-cd
  env:
</code></pre>
<p>Save it, and run <code>kubectl apply -f argocd-server-deployment.yaml</code>.</p>
<p>Now, it's time to edit ingress definition also - as we setup root path we need to delete <code>nginx.ingress.kubernetes.io/rewrite-target:</code> annotation:</p>
<pre><code>annotations:
  kubernetes.io/ingress.class: nginx
  nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
  nginx.ingress.kubernetes.io/ssl-passthrough: &quot;true&quot;
  nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
</code></pre>
<p>After these changes, if I reach <code>https://{ingress-ip}/argo-cd</code> I will be redirected to the <code>https://{ingress-ip}/argo-cd/applications</code>. Everything is working properly.</p>
