Something is weird with the ingress admission controller in toolsbeta. File:
apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: annotations: # Enable client certificate authentication nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" # Create the secret containing the trusted ca certificates # TODO: what to do with this nginx.ingress.kubernetes.io/auth-tls-secret: "default/ca-secret" # Specify the verification depth in the client certificates chain nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1" # Specify an error page to be redirected to verification errors nginx.ingress.kubernetes.io/auth-tls-error-page: "https://jobs.toolsbeta.wmflabs.org/" # Specify if certificates are passed to upstream server nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true" name: toolforge-jobs-api namespace: ingress-nginx-jobs spec: rules: - host: jobs.toolsbeta.wmflabs.org http: paths: - backend: serviceName: http-svc servicePort: 8080 path: /
Error message (I tried a couple of variants):
root@toolsbeta-test-k8s-control-4:~# grep wmflabs ingress.yaml nginx.ingress.kubernetes.io/auth-tls-error-page: "https://jobs.toolsbeta.wmflabs.org/" - host: jobs.toolsbeta.wmflabs.org root@toolsbeta-test-k8s-control-4:~# kubectl apply -f ingress.yaml Error from server: error when creating "ingress.yaml": admission webhook "ingress-admission.tools.wmflabs.org" denied the request: Ingress host must be <toolname>.toolforge.org or tools.wmflabs.org/<toolname> root@toolsbeta-test-k8s-control-4:~# egrep toolforge\|wmflabs ingress.yaml nginx.ingress.kubernetes.io/auth-tls-error-page: "https://jobs.toolsbeta.wmflabs.org/" - host: jobs.toolforge.org root@toolsbeta-test-k8s-control-4:~# kubectl apply -f ingress.yaml Error from server: error when creating "ingress.yaml": admission webhook "ingress-admission.tools.wmflabs.org" denied the request: Ingress host must be <toolname>.toolforge.org or tools.wmflabs.org/<toolname> root@toolsbeta-test-k8s-control-4:~# kubectl logs pod/ingress-admission-98cf75f59-8mrfx -n ingress-admission time="2021-02-19T12:42:09Z" level=info msg="&{0.0.0.0:8080 /etc/webhook/certs/cert.pem /etc/webhook/certs/key.pem [toolforge.org wmflabs.org wmcloud.org toolsbeta.wmflabs.org toolsbeta.wmcloud.org] false}"
This is despite https://gerrit.wikimedia.org/r/c/cloud/toolforge/ingress-admission-controller/+/663230 being deployed already.
I guess the error message is misleading, and what's failing is other stuff like the namespace pattern, or the metadata name, or the like.