REGRESSION: After upgrading to 0.24.0 fake certificate is used instead of the one specified

[gae123]

Is this a BUG REPORT or FEATURE REQUEST? (choose one): BUG/REGRESSION

Before upgrade automatically generated nginx.conf contains:

After upgrade:

NGINX Ingress controller version: 0.24.0 and later

Kubernetes version (use kubectl version):v1.13.7-gke.2

Environment:

• Cloud provider or hardware configuration: GKE
• OS (e.g. from /etc/os-release): ubuntu
• Kernel (e.g. uname -a):
• Install tools:
• Others:

What happened:
After upgrade cannot access hosts any more (get the insecure warning), it turns out that SSL certificates are not installed, not present in nginx.conf

What you expected to happen:
a smooth upgrade

[aledbf]

Closing. Since 0.24.0 the SSL certificates are configured using lua #3808
This means, you will only see the fake certificate pem in the generated nginx.conf file.

[gae123]

For now, setting --enable-dynamic-certificates=false seems to fix the issue. I will try to understand what @aledbf's comment means that I need to change in my config.

Any suggestions will be appreciated, this is something that used to work fine since 0.12.0 and suddenly stopped working on this upgrade.

[aledbf]

@gae123 what's the issue exactly? If you have an issue, please post the ingress controller pod logs

For now, setting --enable-dynamic-certificates=false seems to fix the issue. I

This flag is being removed in the next release (0.26)

[gae123]

It turns out we have code that post edits nginx.conf adding additional server_names matched with a regular expression. So if the server name is foo.bar.com we can also match *-foo.bar.com Unfortunately, there is no cleaner way to currently handle this (see here for discussion).

All that breaks with "dynamic certificates"...

Please do not remove "--enable-dynamic-certificates=false" until this gets addressed somehow.

[aledbf]

Please do not remove "--enable-dynamic-certificates=false" until this gets addressed somehow.

Flag already removed #4356

[aledbf]

All that breaks with "dynamic certificates"...

Please open an issue describing exactly what are you doing.

So if the server name is foo.bar.com we can also match *-foo.bar.com Unfortunately, there is no cleaner way to currently handle this (see here for discussion).

We also added support for multiple aliases #4472