I am using Azure Kubernetes Service to deploy my applications. I deployed application access to it via Ingress. Application must request permissions from another service using https. But in the logs I see this error message
Invalid redirect_uri: "http://test-api.dev.net/signin-oidc"
As if my traffic for application is not using https
ingress.yml
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "test-api.fullname" . -}}
{{- $svcPort := .Values.service.port -}}
{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: networking.k8s.io/v1
{{- else -}}
apiVersion: extensions/v1beta1
{{- end }}
kind: Ingress
metadata:
name: {{ $fullName }}
labels:
{{- include "test-api.labels" . | nindent 4 }}
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/configuration-snippet: |
more_clear_headers Server;
spec:
{{- if .Values.ingress.tls }}
tls:
- hosts:
- {{ .Values.ingress.tls.hosts }}
secretName: {{ .Values.ingress.tls.secretName }}
{{- end }}
rules:
{{- range $key, $value := .Values.ingress.hosts }}
- host: {{ $value | quote }}
http:
paths:
- path: /
pathType: ImplementationSpecific
backend:
service:
name: {{ $fullName }}
port:
number: {{ $svcPort }}
{{- end }}
{{- end }}
service.yml
apiVersion: v1
kind: Secret
metadata:
name: {{ include "test-api.fullname" . }}
labels:
app.kubernetes.io/name: {{ include "test-api.name" . }}
helm.sh/chart: {{ include "test-api.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
data:
{{- toYaml .Values.secretVars | nindent 2 }}
Could you help me? Thanks.
Related
I am trying to migrate the K8S api extensions/v1beta1 to networking.k8s.io/v1
Deprecated API Migration Guide
helm\templates\ingress.yaml (before migration)
{{- if .Values.ingress.enabled -}}
{{- $serviceName := include "sonarqube.fullname" . -}}
{{- $servicePort := .Values.service.externalPort -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: {{ template "sonarqube.fullname" . }}
labels:
app: {{ template "sonarqube.name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
{{- if .Values.ingress.labels }}
{{ .Values.ingress.labels | toYaml | trimSuffix "\n"| indent 4 -}}
{{- end}}
{{- if .Values.ingress.annotations}}
annotations:
{{- range $key, $value := .Values.ingress.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
spec:
rules:
{{- range .Values.ingress.hosts }}
{{- $path := default "/" .path }}
- host: {{ .name }}
http:
paths:
- path: {{ $path }}
backend:
serviceName: {{ $serviceName }}
servicePort: {{ $servicePort }}
- path: {{ printf "%s/*" (trimSuffix "/" $path) }}
backend:
serviceName: {{ $serviceName }}
servicePort: {{ $servicePort }}
helm\templates\ingress.yaml (after migration)
{{- if .Values.ingress.enabled -}}
{{- $serviceName := include "sonarqube.fullname" . -}}
{{- $servicePort := .Values.service.externalPort -}}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: {{ template "sonarqube.fullname" . }}
labels:
app: {{ template "sonarqube.name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
{{- if .Values.ingress.labels }}
{{ .Values.ingress.labels | toYaml | trimSuffix "\n"| indent 4 -}}
{{- end}}
{{- if .Values.ingress.annotations}}
annotations:
{{- range $key, $value := .Values.ingress.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
spec:
rules:
{{- range .Values.ingress.hosts }}
{{- $path := default "/" .path }}
- host: {{ .name }}
http:
paths:
- backend:
service:
name: {{ $serviceName }}
port:
number: {{ $servicePort }}
path: {{ $path }}
pathType: ImplementationSpecific
- backend:
service:
name: {{ $serviceName }}
port:
number: {{ $servicePort }}
path: {{ printf "%s/*" (trimSuffix "/" $path) }}
pathType: ImplementationSpecific
{{- end -}}
{{- if .Values.ingress.tls }}
tls:
{{ toYaml .Values.ingress.tls | indent 4 }}
{{- end -}}
{{- end -}}
And after migration getting into below error:
(in my helm feature branch there is nowhere mention extensions/v1beta1)
Error: UPGRADE FAILED: unable to build kubernetes objects from current release manifest: resource mapping not found for name: "myname-myname" namespace: "" from "": no matches for kind "Ingress" in version "extensions/v1beta1" ensure CRDs are installed first
My K8S ingress is already running on networking.k8s.io/v1
`
abhi#mySystem:$ kubectl get ing myname-myname -n sonarqube -o yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
meta.helm.sh/release-name: sonarqube
meta.helm.sh/release-namespace: sonarqube
nginx.ingress.kubernetes.io/proxy-body-size: 200m
nginx.ingress.kubernetes.io/ssl-redirect: "false"
nginx.org/client-max-body-size: 200m
creationTimestamp: "2021-11-16T14:34:25Z"
generation: 1
labels:
app: sonarqube
app.kubernetes.io/managed-by: Helm
chart: sonarqube-3.10.5
heritage: Helm
release: sonarqube
name: myname-myname
namespace: sonarqube
resourceVersion: "111111111"
uid: 11a1a11a-1111-11aa-a11a-aa1a111aa111
spec:
rules:
- host: sonarqube-dev.ad.xyz.com
http:
paths:
- backend:
service:
name: myname-myname
port:
number: 9000
path: /
pathType: ImplementationSpecific
- backend:
service:
name: myname-myname
port:
number: 9000
path: /*
pathType: ImplementationSpecific
status:
loadBalancer:
ingress:
- ip: 10.110.110.110
Helm Version 3.5.1 | Kubectl Client Version: v1.25.3 | Kubectl Server Version: v1.23.5
I trying to Migrate Kubernetes api extensions/v1beta1 to networking.k8s.io/v1
So I have been trying to fix some charts we inherited and all the others went fine except this 1 which is giving me a headache.
I understand what thew error is telling me
Error: unable to build kubernetes objects from release manifest: error validating "": error validating data: ValidationError(Ingress.spec.rules[0].http.paths): invalid type for io.k8s.api.networking.v1.HTTPIngressRuleValue.paths: got "map", expected "array" but I can't find where this map appears in the spec below. I see the paths being in list format.
Does anyone have any idea where exactly the problem is?
Azure AKS 1.24.0
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "something.fullname" . -}}
{{- $servicePort := .Values.service.port -}}
{{- $ingressPath := .Values.ingress.path -}}
{{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
apiVersion: networking.k8s.io/v1
{{- else if .Capabilities.APIVersions.Has "extensions/v1beta1" }}
apiVersion: extensions/v1beta1
{{- else }}
{{ fail "Unsupported API version"}}
{{- end }}
kind: Ingress
metadata:
name: {{ $fullName }}
labels:
app.kubernetes.io/name: {{ .Chart.Name }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion }}
app.kubernetes.io/component: {{ .Values.component }}
app.kubernetes.io/part-of: {{ .Values.partof }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
{{- with .Values.labels.something}}
{{ toYaml . }}
{{- end }}
{{- with .Values.ingress.annotations }}
annotations:
{{ toYaml . | indent 4 }}
{{- end }}
spec:
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.ingress.hosts }}
- host: {{ . }}
{{- end }}
http:
paths:
{{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
pathType: Prefix
backend:
service:
name: {{ default $fullName .Values.service.name }}
port:
number: {{ .Values.service.port }}
{{- else if .Capabilities.APIVersions.Has "extensions/v1beta1" }}
backend:
serviceName: {{ default $fullName .Values.service.name }}
servicePort: {{ .Values.service.port }}
{{- end }}
{{- end }}
EDIT 1
Doing a helm lint . with the same flags that the helm upgrade --install would do, throws no errors
You have:
paths:
{{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
pathType: Prefix
...
You're missing the actual path:
paths:
- path: /
{{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
pathType: Prefix
...
When I try to do helm install <chartname> . -f values.yaml -n namespace, i am getting:
Error: template: pid-dm-rd-guacamole/templates/ingress.yaml:1:8: executing "pid-dm-rd-guacamole/templates/ingress.yaml" at <$.Values.ingress.enabled>: nil pointer evaluating interface {}.enabled
Can anyone please suggest how we can avoid this error, here I have attached my ingress.yaml and ingress section in values.yaml
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "device-management.fullname" . -}}
{{- $svcPort := .Values.service.port -}}
{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: networking.k8s.io/v1beta1
{{- else -}}
apiVersion: extensions/v1beta1
{{- end }}
kind: Ingress
metadata:
name: {{ $fullName }}
labels:
{{- include "device-management.labels" . | nindent 4 }}
{{- with .Values.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ . }}
backend:
serviceName: {{ $fullName }}
servicePort: {{ $svcPort }}
{{- end }}
{{- end }}
{{- end }}
ingress:
enabled: true
annotations:
ingress.kubernetes.io/ssl-redirect: "true"
kubernetes.io/tls-acme: "true"
certmanager.k8s.io/cluster-issuer: letsencrypt-prod
paths: []
# - backend:
# serviceName: ssl-redirect
# servicePort: use-annotation
# - backend:
# # Don't use string here, use only integer value!
# servicePort: 443
#nginx.ingress.kubernetes.io/proxy-buffering: "off"
path: /
hosts:
#what is the hostname?
- host: guacamole.****.corp.com
paths:
- path: /
backend:
serviceName: guacamole.****.corp.com
servicePort: 80
tls:
- hosts:
- guacamole.danaher.corp.com
As #Ramanichandran mentioned in comment section problem is solved by adding a missing value in first line in the ingress yaml. Line should look like: .Values.guacamole.ingress.enabled. The guacamole value was missed to add.
I have the following definition of ingress.yaml
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "onion.fullname" . -}}
{{- $svcPort := .Values.service.port -}}
{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: networking.k8s.io/v1
{{- else -}}
apiVersion: networking.k8s.io/v1
{{- end }}
kind: Ingress
metadata:
name: {{ $fullName }}
labels:
{{- include "onion.labels" . | nindent 4 }}
{{- with .Values.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ . }}
backend:
serviceName: {{ $fullName }}
servicePort: {{ $svcPort }}
{{- end }}
{{- end }}
{{- end }}
And the value.yaml created is as below:
ingress:
name: external
enabled: true
type: LoadBalancer
annotations:
kubernetes.io/ingress.class: "nginx-environment"
hosts:
- host: "onion.api.environment.cloud.google.com"
http:
paths:
- backend:
serviceName: internal
servicePort: 8081
path: "/"
tls:
- secretName: "onion.api.environment.cloud.google.com-tls"
hosts:
- "onion.api.environment.cloud.google.com"
- "*.cloud.google.com"
I keep getting the following error:
Error: unable to build kubernetes objects from release manifest: error validating "": error validating data: ValidationError(Ingress.spec.rules[0].http): missing required field "paths" in io.k8s.api.networking.v1.HTTPIngressRuleValue
Can someone advice please what am I doing wrong in the values.yaml file?
The correct template for "ingress api: networking.k8s.io/v1" should be:
spec:
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ . }}
pathType: Prefix
backend:
service:
name: {{ $fullName }}
port:
number: {{ $svcPort }}
{{- end }}
{{- end }}
{{- end }}
and hence the following value.yaml would match
ingress:
name: external
enabled: true
type: LoadBalancer
#loadBalancerSourceRanges: ["0.0.0.0/0"]
#externalPort: 443
#internalPort: 80
annotations:
kubernetes.io/ingress.class: "nginx-environment"
nginx.ingress.kubernetes.io/rewrite-target: "/"
nginx.ingress.kubernetes.io/enable-cors: "true"
nginx.ingress.kubernetes.io/cors-allow-methods: "GET, POST, PUT, DELETE, OPTIONS, HEAD"
nginx.ingress.kubernetes.io/cors-allow-origin: "*"
nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
nginx.ingress.kubernetes.io/cors-allow-headers: "*"
nginx.ingress.kubernetes.io/cors-max-age: "3600"
nginx.ingress.kubernetes.io/from-to-www-redirect: "true"
tls: []
# - hosts:
# - "onion.api.environment.cloud.google.com"
# - "*.cloud.ajw-group.com"
# secretName: onion.api.environment.cloud.google.com-tls
hosts:
- host: onion.api.environment.cloud.google.com
#http:
paths:
- /
I know this is some kind of syntax/yaml structure related error but the message is so cryptic I have no idea what the issue is:
Error: render error in "mychart/templates/ingress.yaml": template: mychart/templates/ingress.yaml:35:37: executing "mychart/templates/ingress.yaml" at <.Values.network.appP...>: can't evaluate field Values in type interface {}
This is in my values.yaml:
network:
appPort: 4141
This is the ingress.yaml:
{{- $fullName := include "mychart.fullname" . -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: {{ $fullName }}
labels:
app.kubernetes.io/name: {{ include "mychart.name" . }}
helm.sh/chart: {{ include "mychart.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- with .Values.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ . }}
backend:
serviceName: {{ $fullName }}
servicePort: {{ .Values.network.appPort }}
{{- end }}
{{- end }}
Why doesn't {{ .Values.network.appPort }} work? I have used values with this same structure in other places
Isn't it just scope issue?
Try something as below
{{- $fullName := include "mychart.fullname" . -}}
{{- $networkAppPort := .Values.network.appPort -}}
...
.... omitted code
...
http:
paths:
{{- range .paths }}
- path: {{ . }}
backend:
serviceName: {{ $fullName }}
servicePort: {{ $networkAppPort }}
{{- end }}
{{- end }}
In the range block . refers to the current value in the execution time. Instead of . you can use $ to access to the root data object in the range block instead of declaring top level variables.
Example:
{{- range $host := .Values.ingress.hosts }}
- host: {{ $host }}
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: frontend
port:
number: {{ $.Values.frontend.service.port }}
{{- end}}
I use helm3 and I have the same error message, when i run helm template my-chart. In my case, i have define wrongly in values.yaml,
WRONG configuration (In my values.yaml missing path under paths):
ingress:
enabled: true
annotations:
kubernetes.io/ingress.class: "nginx"
nginx.ingress.kubernetes.io/rewrite-target: /$2
nginx.ingress.kubernetes.io/ssl-redirect: "false"
nginx.ingress.kubernetes.io/use-regex: "true"
hosts:
- host: "dev"
paths:
- /dev(/|$)(.*)
tls: []
correct the ingress definition like this , it works
ingress:
enabled: true
annotations:
kubernetes.io/ingress.class: "nginx"
nginx.ingress.kubernetes.io/rewrite-target: /$2
nginx.ingress.kubernetes.io/ssl-redirect: "false"
nginx.ingress.kubernetes.io/use-regex: "true"
hosts:
- host:
paths:
- path: "/dev(/|$)(.*)"
tls: []
my ingress template, ingress.yaml, which is generated automatically via helm
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "bsb-lookup.fullname" . -}}
{{- $svcPort := .Values.service.port -}}
{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: networking.k8s.io/v1beta1
{{- else -}}
apiVersion: extensions/v1beta1
{{- end }}
kind: Ingress
metadata:
name: {{ $fullName }}
labels:
{{- include "bsb-lookup.labels" . | nindent 4 }}
{{- with .Values.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ .path }}
backend:
serviceName: {{ $fullName }}
servicePort: {{ $svcPort }}
{{- end }}
{{- end }}
{{- end }}
for YAML it is also required to have the immediate parent of any optional value.
Like you are trying to do a check "a.b.c" in some yaml during helm build its gives similar error. it is required to have a.b at least in the default values.yaml.
Solved by going details in - https://github.com/helm/helm/issues/5435