TLS handshake error with ingress enabled on Kubernetes deployment

[david-baylibre]

Hi,
Ingresses seem to communicate without TLS when mode is ingress and passthrough is disabled, the controller logs some http: TLS handshake error from 10.0.19.33:34070: tls: first record does not look like a TLS handshake when I try to run an exporter.

I did not find a way to disable TLS on the pod.
Switching from nginx.ingress.kubernetes.io/backend-protocol: GRPC to nginx.ingress.kubernetes.io/backend-protocol: GRPCS fixes the problem in my case.

Am I missing something?

Configuration:

jumpstarter-controller:
  grpc:
    tls:
      mode: "reencrypt"
      routercertsecret: router.mydomain-tls
      controllerCertSecret: controller.mydomain-tls
    mode: "ingress"
    ingress:
      class: nginx

Deployment:

helm upgrade jumpstarter --install oci://quay.io/jumpstarter-dev/helm/jumpstarter --version=0.7.0-1217-g9eadf19b -f values.yaml

[mangelajo]

Hey, we do TLS in passthrough mode for performance reasons, specially the router that needs to do high throughput/low latency.

Also I would recommend you to give a try to our operator, we have been working on it, and part of our plan is to make the helm charts a wrapper of the operator at some point.

The operator is now able to integrate with Cert manager and request certificates from any cert-issuer you want, assign them to the controller and router.

Please ping me in the matrix channel if you want some help trying the operator out.

[mangelajo]

Sorry, I didn't answer your questions I think

Hi, Ingresses seem to communicate without TLS when mode is ingress and passthrough is disabled, the controller logs some http: TLS handshake error from 10.0.19.33:34070: tls: first record does not look like a TLS handshake when I try to run an exporter.

I did not find a way to disable TLS on the pod. Switching from nginx.ingress.kubernetes.io/backend-protocol: GRPC to nginx.ingress.kubernetes.io/backend-protocol: GRPCS fixes the problem in my case.

Hmm I think there is no way to disable it on the pod today, we could add a flag/env var to the jumpstarter-controller in the controller/ dir.

Am I missing something?

Configuration:

jumpstarter-controller:
  grpc:
    tls:
      mode: "reencrypt"
      routercertsecret: router.mydomain-tls
      controllerCertSecret: controller.mydomain-tls
    mode: "ingress"
    ingress:
      class: nginx

Deployment:

helm upgrade jumpstarter --install oci://quay.io/jumpstarter-dev/helm/jumpstarter --version=0.7.0-1217-g9eadf19b -f values.yaml

[mangelajo]

Handled in #384 for now, it if works for you I will close this one.

[raballew]

@david-baylibre Looking at #297 it seems some of the issues you were facing have been resolved. Can I go ahead and close this one too?

[david-baylibre]

@raballew Yes it's sorted, thanks