Nginx Ingress Controller - Config file not updated when a secret is updated

[alanhartless]

It seems that updating a secret does not trigger the config file to be updated. I have a script that is automating let's encrypt. But after the certificate is fetched and the Secret resource updated, the nginx configuration is not rebuilt (so hosts waiting on the certificate are updated). Is this intentional?

[aledbf]

Is this intentional?

Currently there is no watch on secret changes. Next add/update in a service or endpoint the secret will be regenerated with the new content of the secret

[bprashanth]

yeah I'm going to write a method that does the reverse lookup soon (secret to ingress) but I figured people aren't really going to cut it too close to cert expiration, so an extra couple of minutes to update pems is OK

[alanhartless]

Ok. No big deal. I worked around it. For my use case, certs will be updated relatively frequently as new domains are added up to Let's Encrypt limit of 100 domains/cert.

[bprashanth]

Just make it resync more often> :)
If you want to write some go code, the reverse lookup shoudlnt' be too hard. You'll just need to watch secrets and anytime one changes, force all associated ingresses to sync.

[bprashanth]

Fyi you can configure the resync interval through https://github.com/kubernetes/contrib/blob/master/ingress/controllers/nginx/main.go#L76 like https://github.com/kubernetes/contrib/blob/master/ingress/controllers/nginx/rc.yaml#L98. I don't think this will have an adverse effect on nginx, we should only be hupping it if the config or something else actually changed.

[alanhartless]

Ah, I didn't even notice the resync flag. Please forgive my stupidity if I'm misinterpreting that code; is that re-syncing every 30 seconds already by default? Seems like it didn't catch the newly available cert within several minutes that I waited.

[bprashanth]

Seems like it didn't catch the newly available cert within several minutes that I waited.

That sounds like a bug, I'll need to investigate when I have some time to comment more

[aledbf]

That sounds like a bug,

Actually the issue here is that the generated nginx.conf file is the same and in that case nginx is not reloaded.

[bprashanth]

Ah, so compare certificates as well?
Actually for the gce controller I'm doing a 2 phase thing, where I create the new cert, try switching, and delete the old if it passes (#791). I figured people won't want to black hole traffic if the second cert is bad but we've overwritten the first. If we did this the config would change.