1e66a54974
When the ingress controller loads certificates (new ones or following a
secret update), it performs a series of check to ensure its validity.
In our systems, we detected a case where, when the secret object is
compromised, for example when the certificate does not match the secret
key, different pods of the ingress controller are serving a different
version of the certificate.
This behaviour is due to the cache mechanism of the ingress controller,
keeping the last known certificate in case of corruption. When this
happens, old ingress-controller pods will keep serving the old one,
while new pods, by failing to load the corrupted certificates, would
use the default certificate, causing invalid certificates for its
clients.
This generates a random error on the client side, depending on the
actual pod instance it reaches.
In order to allow detecting occurences of those situations, add a metric
to expose, for all ingress controlller pods, detailed informations of
the currently loaded certificate.
This will, for example, allow setting an alert when there is a
certificate discrepency across all ingress controller pods using a query
similar to `sum(nginx_ingress_controller_ssl_certificate_info{host="name.tld"})by(serial_number)`
This also allows to catch other exceptions loading certificates (failing
to load the certificate from the k8s API, ...
Co-authored-by: Daniel Ricart <danielricart@users.noreply.github.com>
Co-authored-by: Daniel Ricart <danielricart@users.noreply.github.com>
|
||
|---|---|---|
| .github | ||
| build | ||
| charts/ingress-nginx | ||
| cmd | ||
| deploy | ||
| docs | ||
| hack | ||
| images | ||
| internal | ||
| rootfs | ||
| test | ||
| version | ||
| .codecov.yml | ||
| .gitignore | ||
| .luacheckrc | ||
| Changelog.md | ||
| cloudbuild.yaml | ||
| code-of-conduct.md | ||
| CONTRIBUTING.md | ||
| go.mod | ||
| go.sum | ||
| ISSUE_TRIAGE.md | ||
| LICENSE | ||
| Makefile | ||
| mkdocs.yml | ||
| OWNERS | ||
| OWNERS_ALIASES | ||
| README.md | ||
| RELEASE.md | ||
| SECURITY.md | ||
| SECURITY_CONTACTS | ||
| stable.txt | ||
| TAG | ||
Ingress NGINX Controller
Overview
ingress-nginx is an Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer.
Learn more about Ingress on the main Kubernetes documentation site.
Get started
See the Getting Started document.
Troubleshooting
If you encounter issues, review the troubleshooting docs, file an issue, or talk to us on the #ingress-nginx channel on the Kubernetes Slack server.
Changelog
See the list of releases to find out about feature changes.
For detailed changes for each release; please check the Changelog.md file.
For detailed changes on the ingress-nginx helm chart, please check the following CHANGELOG.md file.
Support Versions table
| Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version |
|---|---|---|---|
| v1.1.1 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.1.0 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.0.5 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.0.4 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.0.3 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.0.2 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.0.1 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.0.0 | 1.22, 1.21, 1.20, 1.19 | 3.13.5 | 1.20.1 |
| v0.50.0 | 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v0.49.3 | 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v0.49.2 | 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v0.49.1 | 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v0.49.0 | 1.21, 1.20, 1.19 | 3.13.5 | 1.20.1 |
| v0.48.1 | 1.21, 1.20, 1.19 | 3.13.5 | 1.20.1 |
| v0.47.0 | 1.21, 1.20, 1.19 | 3.13.5 | 1.20.1 |
† This build is patched against CVE-2021-23017.
See this article if you want upgrade to the stable Ingress API.
Get Involved
Thanks for taking the time to join our community and start contributing!
-
This project adheres to the Kubernetes Community Code of Conduct. By participating in this project, you agree to abide by its terms.
-
Contributing: Contributions of all kind are welcome!
-
Read
CONTRIBUTING.mdfor information about setting up your environment, the workflow that we expect, and instructions on the developer certificate of origin that we require. -
Join our Kubernetes Slack channel for developer discussion : #ingress-nginx-dev.
-
Submit github issues for any feature enhancements, bugs or documentation problems. Please make sure to read the Issue Reporting Checklist before opening an issue. Issues not conforming to the guidelines may be closed immediately.
-
-
Support: Join the the #ingress-nginx-users channel inside the Kubernetes Slack to ask questions or get support from the maintainers and other users.
- The github issues in the repository are exclusively for bug reports and feature requests.
-
Discuss: Tweet using the
#IngressNginxhashtag.