apache / apache/apisix-helm-chart
ingress-controller chart: Gateway service not listening on https port
- Dominant language
- Go Template
- Stars
- 289
- Forks
- 282
- Avg merge
- 15h 55m
- Merged PRs (30d)
- 3
Description
Enabling TLS on the `ingress-controller` gateway service (`apisix-ingress-controller-apisix-gateway`) doesn't make the pod listen on port 9443.
This causes refused connections since the LoadBalancer's public IP doesn't have anywhere to connect:
```
curl: (7) Failed to connect to test-apisix.example.com port 443 after 262 ms: Connection refused
```
Configured `ingress-controller` as an `apisix` subchart, but the same applies for the standalone chart:
```
ingress-controller:
enabled: true
config:
# misconfig due to a hardcoded value https://github.com/apache/apisix-helm-chart/issues/774
httpListen: ":9080"
ingressPublishService: "ingress-apisix/apisix-ingress-controller-apisix-gateway"
apisix:
adminAPIVersion: "v3"
existingSecret: "admin-creds"
existingSecretAdminKeyKey: "admin"
gateway:
type: LoadBalancer
externalTrafficPolicy: Local
tls:
enabled: true <== DOESN'T WORK
```
Only the HTTP port (9080) is specified in the `deployment.yaml` [template](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix-ingress-controller/templates/deployment.yaml#L97-L99) and there's no optional setting for the TLS port like the `apisix` chart's [template](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/templates/deployment.yaml#L111).
The only place that the `tls` key is used is in the `etcd` server sidecar [here](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix-ingress-controller/templates/deployment.yaml#L147), which also looks a bit mistakenly copied.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by rendering the ingress-controller chart and inspect charts/apisix-ingress-controller/templates/deployment.yaml around the HTTP container port and the etcd sidecar TLS reference. Compare it with charts/apisix/templates/deployment.yaml, then verify that enabling gateway TLS causes the pod and service to expose and listen on port 9443.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 38/100