Multiple domains and SSL Certificates with GCP's kubernetes ingress

1
votes

I am exposing a micro service running on GCP's kubernetes engine via Google's Ingress load balancer. According to Here the load balancer supports multiple SSL certificates for different domain namess.

However, only the first specified SSL certificate is returned and therefore I receive a Your connection is not private warning for a domain-b. I would love to make an ingress controller for several domains each with their own certificate.

The following approach fails:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: some-name
spec:  
  tls:
  - hosts: 
    - www.domain-a.net
    - domain-a
    secretName: domain-a-net
  - hosts: 
    - www.domain-b.org
    - domain-b.org
    secretName: domain-b-org
  backend:
    serviceName: some-name
    servicePort: 443

Any idea how to correctly benefit from Google's Ingress Multi SSL?

1
kubernetesgoogle-cloud-platformgcloudgoogle-kubernetes-enginekubernetes-ingress
Hopefully this will help you. It's almost one year old but I think it remains current: medium.com/google-cloud/… – DazWilkin
Can you run curl -k -v on these hostnames and see which domain returns which cert –and add that to the question? The feature is supposed to work as documented. – Ahmet Alp Balkan
Hi @AhmetAlpBalkan-Google I just ran curl -k -v for both domains. I always get the secret for domain-a returned. After some testing, I have the feeling that I always get the first specified secretName in my return (domain-a-net) i.e. if I would switch the two hosts in aboves YAML file I would receive domain-b-org as a result. Thanks for your help! – Robert Weindl
@RobertWeindl please try that out, and if that's the case, I'll have it investigated. Also feel free to report this on github.com/kubernetes/ingress-gce/issues if you have reliable repo. This is critical. – Ahmet Alp Balkan
@AhmetAlpBalkan-Google Thanks for your feedback and help. I verified that behavior and opened github.com/kubernetes/ingress-gce/issues/466 – Robert Weindl

1 Answers

0
votes

Updating GCE and GKE to latest version, and then redeploying the Ingress resource helped!