K
Q

Managed Certificate in Ingress, Domain Status is FailedNotVisible

1/17/2020

I'm simply following the tutorial here: https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#creating_an_ingress_with_a_managed_certificate

Everything works fine until I deploy my certificate and wait 20 minutes for it to show up as:

Status:
  Certificate Name:    daojnfiwlefielwrfn
  Certificate Status:  Provisioning
  Domain Status:
    Domain:  moviedecisionengine.com
    Status:  FailedNotVisible

That domain clearly works so what am I missing?

EDIT:

Here's the Cert:

apiVersion: networking.gke.io/v1beta1
kind: ManagedCertificate
metadata:
    name: moviedecisionengine
spec:
    domains:
        - moviedecisionengine.com

The Ingress:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    ingress.gcp.kubernetes.io/pre-shared-cert: mcrt-14cb8169-25ba-4712-bca5-cb612562a00b
    ingress.kubernetes.io/backends: '{"k8s-be-31721--1cd1f38313af9089":"HEALTHY"}'
    ingress.kubernetes.io/forwarding-rule: k8s-fw-default-showcase-mde-ingress--1cd1f38313af9089
    ingress.kubernetes.io/https-forwarding-rule: k8s-fws-default-showcase-mde-ingress--1cd1f38313af9089
    ingress.kubernetes.io/https-target-proxy: k8s-tps-default-showcase-mde-ingress--1cd1f38313af9089
    ingress.kubernetes.io/ssl-cert: mcrt-14cb8169-25ba-4712-bca5-cb612562a00b
    ingress.kubernetes.io/target-proxy: k8s-tp-default-showcase-mde-ingress--1cd1f38313af9089
    ingress.kubernetes.io/url-map: k8s-um-default-showcase-mde-ingress--1cd1f38313af9089
    kubernetes.io/ingress.global-static-ip-name: 34.107.208.110
    networking.gke.io/managed-certificates: moviedecisionengine
  creationTimestamp: "2020-01-16T19:44:13Z"
  generation: 4
  name: showcase-mde-ingress
  namespace: default
  resourceVersion: "1039270"
  selfLink: /apis/extensions/v1beta1/namespaces/default/ingresses/showcase-mde-ingress
  uid: 92a2f91f-3898-11ea-b820-42010a800045
spec:
  backend:
    serviceName: showcase-mde
    servicePort: 80
  rules:
  - host: moviedecisionengine.com
    http:
      paths:
      - backend:
          serviceName: showcase-mde
          servicePort: 80
  - host: www.moviedecisionengine.com
    http:
      paths:
      - backend:
          serviceName: showcase-mde
          servicePort: 80
status:
  loadBalancer:
    ingress:
    - ip: 34.107.208.110

And lastly, the load balancer:

apiVersion: v1
kind: Service
metadata:
  creationTimestamp: "2020-01-13T22:41:27Z"
  labels:
    app: showcase-mde
  name: showcase-mde
  namespace: default
  resourceVersion: "2298"
  selfLink: /api/v1/namespaces/default/services/showcase-mde
  uid: d5a77d7b-3655-11ea-af7f-42010a800157
spec:
  clusterIP: 10.31.251.46
  externalTrafficPolicy: Cluster
  ports:
  - nodePort: 31721
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: showcase-mde
  sessionAffinity: None
  type: LoadBalancer
status:
  loadBalancer:
    ingress:
    - ip: 35.232.156.172

For the full output of kubectl describe managedcertificate moviedecisionengine:

Name:         moviedecisionengine
Namespace:    default
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"networking.gke.io/v1beta1","kind":"ManagedCertificate","metadata":{"annotations":{},"name":"moviedecisionengine","namespace...
API Version:  networking.gke.io/v1beta1
Kind:         ManagedCertificate
Metadata:
  Creation Timestamp:  2020-01-17T16:47:19Z
  Generation:          3
  Resource Version:    1042869
  Self Link:           /apis/networking.gke.io/v1beta1/namespaces/default/managedcertificates/moviedecisionengine
  UID:                 06c97b69-3949-11ea-b820-42010a800045
Spec:
  Domains:
    moviedecisionengine.com
Status:
  Certificate Name:    mcrt-14cb8169-25ba-4712-bca5-cb612562a00b
  Certificate Status:  Provisioning
  Domain Status:
    Domain:  moviedecisionengine.com
    Status:  FailedNotVisible
Events:      <none>
-- AlxVallejo
google-kubernetes-engine
kubernetes
kubernetes-ingress

Similar Questions

Jenkins master unable to spin up slaves on k8s due to malformed label
Set container environment variables while creating a deployment with kubectl create
Local Consul join K8s Consul Mac
Using Kubernetes Python Client Get Pod Proxy For Authenticated Endpoint

1 Answer

1/21/2020

I was successful in using Managedcertificate with GKE Ingress resource.

Let me elaborate on that:

Steps to reproduce:

  • Create IP address with gcloud
  • Update the DNS entry
  • Create a deployment
  • Create a service
  • Create a certificate
  • Create a Ingress resource

Create IP address with gcloud

Invoke below command to create static ip address:

$ gcloud compute addresses create example-address --global

Check newly created IP address with below command:

$ gcloud compute addresses describe example-address --global

Update the DNS entry

Go to GCP -> Network Services -> Cloud DNS.

Edit your zone with A record with the same address that was created above.

Wait for it to apply.

Check with $ nslookup DOMAIN.NAME if the entry is pointing to the appropriate address.

Create a deployment

Below is example deployment which will respond to traffic:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello
spec:
  selector:
    matchLabels:
      app: hello
      version: 1.0.0
  replicas: 3
  template:
    metadata:
      labels:
        app: hello
        version: 1.0.0
    spec:
      containers:
      - name: hello
        image: "gcr.io/google-samples/hello-app:1.0"
        env:
        - name: "PORT"
          value: "50001"

Apply it with command $ kubectl apply -f FILE_NAME.yaml

You can change this deployment to suit your application but be aware of the ports that your application will respond to.

Create a service

Use the NodePort as it's the same as in the provided link:

apiVersion: v1
kind: Service
metadata:
  name: hello-service
spec:
  type: NodePort
  selector:
    app: hello
    version: 1.0.0
  ports:
  - name: hello-port
    protocol: TCP
    port: 50001
    targetPort: 50001

Apply it with command $ kubectl apply -f FILE_NAME.yaml

Create a certificate

As shown in guide you can use below example to create ManagedCertificate:

apiVersion: networking.gke.io/v1beta1
kind: ManagedCertificate
metadata:
  name: example-certificate 
spec:
  domains:
    - DOMAIN.NAME

Apply it with command $ kubectl apply -f FILE_NAME.yaml

The status FAILED_NOT_VISIBLE indicates that certificate provisioning failed for a domain because of a problem with DNS or the load balancing configuration. Make sure that DNS is configured so that the certificate's domain resolves to the IP address of the load balancer. -- Google Cloud documentation

Creation of this certificate should be affected by DNS entry that you provided earlier.

Create a Ingress resource

Below is example for Ingress resource which will use ManagedCertificate:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: example-address
    networking.gke.io/managed-certificates: example-certificate
spec:
  rules:
  - host: DOMAIN.NAME
    http:
      paths:
      - path: /
        backend:
          serviceName: hello-service
          servicePort: hello-port

Apply it with command $ kubectl apply -f FILE_NAME.yaml

It took about 20-25 minutes for it to fully work.

-- Dawid Kruk
Source: StackOverflow