apache / apache/apisix-helm-chart

ingress-controller chart: Gateway service not listening on https port

Open
#777 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go Template
Stars
289
Forks
282
Avg merge
15h 55m
Merged PRs (30d)
3

Description

Enabling TLS on the `ingress-controller` gateway service (`apisix-ingress-controller-apisix-gateway`) doesn't make the pod listen on port 9443.

This causes refused connections since the LoadBalancer's public IP doesn't have anywhere to connect:
```
curl: (7) Failed to connect to test-apisix.example.com port 443 after 262 ms: Connection refused
```

Configured `ingress-controller` as an `apisix` subchart, but the same applies for the standalone chart:
```
ingress-controller:
enabled: true
config:
# misconfig due to a hardcoded value https://github.com/apache/apisix-helm-chart/issues/774
httpListen: ":9080"
ingressPublishService: "ingress-apisix/apisix-ingress-controller-apisix-gateway"
apisix:
adminAPIVersion: "v3"
existingSecret: "admin-creds"
existingSecretAdminKeyKey: "admin"
gateway:
type: LoadBalancer
externalTrafficPolicy: Local
tls:
enabled: true <== DOESN'T WORK
```

Only the HTTP port (9080) is specified in the `deployment.yaml` [template](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix-ingress-controller/templates/deployment.yaml#L97-L99) and there's no optional setting for the TLS port like the `apisix` chart's [template](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/templates/deployment.yaml#L111).

The only place that the `tls` key is used is in the `etcd` server sidecar [here](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix-ingress-controller/templates/deployment.yaml#L147), which also looks a bit mistakenly copied.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by rendering the ingress-controller chart and inspect charts/apisix-ingress-controller/templates/deployment.yaml around the HTTP container port and the etcd sidecar TLS reference. Compare it with charts/apisix/templates/deployment.yaml, then verify that enabling gateway TLS causes the pod and service to expose and listen on port 9443.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.