title: Kubernetes NGINX Ingress Controller not picking up TLS Certificates
body: <p>I setup a new kubernetes cluster on GKE using the <a href="https://github.com/kubernetes/ingress-nginx" rel="noreferrer">nginx-ingress</a> controller. TLS is not working, it's using the fake certificates.</p>
  
  <p>There is a lot of configuration detail so I made a repo - <a href="https://github.com/jobevers/test_ssl_ingress" rel="noreferrer">https://github.com/jobevers/test_ssl_ingress</a></p>
  
  <p>In short the steps were</p>
  
  <ul>
  <li>create a new cluster without GKE's load balancer</li>
  <li>create a tls secret with my key and cert</li>
  <li>create an nginx-ingress deployment / pod</li>
  <li>create an ingress controller</li>
  </ul>
  
  <p>The nginx-ingress config comes from <a href="https://zihao.me/post/cheap-out-google-container-engine-load-balancer/" rel="noreferrer">https://zihao.me/post/cheap-out-google-container-engine-load-balancer/</a> (and looks very similar to a lot of the examples in the ingress-nginx repo).</p>
  
  <p>My ingress.yaml is nearly identical to <a href="https://github.com/kubernetes/ingress-nginx/blob/master/examples/tls-termination/nginx/nginx-tls-ingress.yaml" rel="noreferrer">the example one</a></p>
  
  <p>When I run curl, I get </p>
  
  <pre><code>$ curl -kv https://35.196.134.52
  [...]
  *    common name: Kubernetes Ingress Controller Fake Certificate (does not match '35.196.134.52')
  [...]
  *    issuer: O=Acme Co,CN=Kubernetes Ingress Controller Fake Certificate
  [...]
  </code></pre>
  
  <p>which shows that I'm still using the default certificates.</p>
  
  <p>How am I supposed to get it using mine?</p>
  
  <hr>
  
  <p><a href="https://github.com/jobevers/test_ssl_ingress/blob/master/ingress.yaml" rel="noreferrer">Ingress definition</a></p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: test-ssl-ingress
    annotations:
      kubernetes.io/ingress.class: "nginx"
  spec:
    tls:
      - secretName: tls-secret
    rules:
    - http:
        paths:
        - path: /
          backend:
            serviceName: demo-echo-service
            servicePort: 80
  </code></pre>
  
  <hr>
  
  <p><a href="https://github.com/jobevers/test_ssl_ingress/blob/master/setup_cluster_with_ssl.sh#L22" rel="noreferrer">Creating the secret</a>:</p>
  
  <pre><code>kubectl create secret tls tls-secret --key tls/privkey.pem --cert tls/fullchain.pem
  </code></pre>
  
  <hr>
  
  <p>Debugging further, the certificate is being found and exist on the server:</p>
  
  <pre><code>$ kubectl -n kube-system exec -it $(kubectl -n kube-system get pods | grep ingress | head -1 | cut -f 1 -d " ") -- ls -1 /ingress-controller/ssl/
  default-fake-certificate-full-chain.pem
  default-fake-certificate.pem
  default-tls-secret-full-chain.pem
  default-tls-secret.pem
  </code></pre>
  
  <p>And, from the log, I see</p>
  
  <pre><code>kubectl -n kube-system log -f $(kubectl -n kube-system get pods | grep ingress | head -1 | cut -f 1 -d " ")
  [...]
  I1013 17:21:45.423998       6 queue.go:111] syncing default/test-ssl-ingress
  I1013 17:21:45.424009       6 backend_ssl.go:40] starting syncing of secret default/tls-secret
  I1013 17:21:45.424135       6 ssl.go:60] Creating temp file /ingress-controller/ssl/default-tls-secret.pem236555242 for Keypair: default-tls-secret.pem
  I1013 17:21:45.424946       6 ssl.go:118] parsing ssl certificate extensions
  I1013 17:21:45.743635       6 backend_ssl.go:102] found 'tls.crt' and 'tls.key', configuring default/tls-secret as a TLS Secret (CN: [...])
  [...]
  </code></pre>
  
  <p>But, looking at the nginx.conf, its still using the fake certs:</p>
  
  <pre><code>$ kubectl -n kube-system exec -it $(kubectl -n kube-system get pods | grep ingress | head -1 | cut -f 1 -d " ") -- cat /etc/nginx/nginx.conf | grep ssl_cert
          ssl_certificate                         /ingress-controller/ssl/default-fake-certificate.pem;
          ssl_certificate_key                     /ingress-controller/ssl/default-fake-certificate.pem;
  </code></pre>