How do you enable SSL Passthrough in the ingress deployment

[pglockwo]

Hi, I am trying to enable ingress on minikube and then allow --enable-ssl-passthrough

I have tried editing the deployment with kubectl

I have tied patching the deployment

but everything I try results in no changes to the underlying resource.

My question is, is ssl passthrough even possible on the version of ingress that comes as an addon to minikube and if so how do you do it.

I would really appreciate the help.

Thanks,

Paul

[avif]

Can't answer your question, but I can offer a workaround:
Disable ingress addon
minikube addons disable ingress

If you are using Helm 3, add stable repo
helm repo add stable https://kubernetes-charts.storage.googleapis.com/

Install nginx ingress controller with "ssl-passthrough" enabled

helm upgrade ingress stable/nginx-ingress \
  --install \
  --namespace kube-system \
  --set rbac.create=true \
  --set "controller.extraArgs.enable-ssl-passthrough=" \
  --set controller.hostNetwork=true \
  --set "controller.extraArgs.report-node-internal-ip-address="

You could do this without Helm too, but you get the point.

Ref

[avif]

I also get the feeling like you are trying to run Strimzi kafka on minikube with ingress external like I did, so here's a working example just in case:
Install ingress controller like previously described.

Install strimzi operator.

Apply a kafka cluster configuration with ingress external, TLS and some user:

$ cat kafka.yaml
apiVersion: kafka.strimzi.io/v1beta1
kind: Kafka
metadata:
  name: my-cluster
spec:
  kafka:
    version: 2.3.0
    replicas: 3
    listeners:
      tls: {}
      external:
        type: ingress
        authentication:
          type: tls
        configuration:
          bootstrap:
            host: bootstrap.kafka.local
          brokers:
            - broker: 0
              host: broker-0.kafka.local
            - broker: 1
              host: broker-1.kafka.local
            - broker: 2
              host: broker-2.kafka.local
    config:
      offsets.topic.replication.factor: 1
      transaction.state.log.replication.factor: 1
      transaction.state.log.min.isr: 1
      log.message.format.version: "2.3"
    storage:
      type: ephemeral
  zookeeper:
    replicas: 3
    storage:
      type: ephemeral
  entityOperator:
    topicOperator: {}
    userOperator: {}
---
apiVersion: kafka.strimzi.io/v1beta1
kind: KafkaTopic
metadata:
  name: my-topic
  labels:
    strimzi.io/cluster: my-cluster
spec:
  partitions: 1
  replicas: 1
  config:
    retention.ms: 7200000
    segment.bytes: 1073741824  
---
apiVersion: kafka.strimzi.io/v1beta1
kind: KafkaUser
metadata:
  name: my-user
  labels:
    strimzi.io/cluster: my-cluster
spec:
  authentication:
    type: tls
  authorization:
    type: simple
    acls:
      # Example consumer Acls for topic my-topic suing consumer group my-group
      - resource:
          type: topic
          name: my-topic
          patternType: literal
        operation: Read
        host: "*"
      - resource:
          type: topic
          name: my-topic
          patternType: literal
        operation: Describe
        host: "*"
      - resource:
          type: group
          name: my-group
          patternType: literal
        operation: Read
        host: "*"
      # Example Producer Acls for topic my-topic
      - resource:
          type: topic
          name: my-topic
          patternType: literal
        operation: Write
        host: "*"
      - resource:
          type: topic
          name: my-topic
          patternType: literal
        operation: Create
        host: "*"
      - resource:
          type: topic
          name: my-topic
          patternType: literal
        operation: Describe
        host: "*"
$ kubectl create ns kafka
$ kubectl -n kafka apply -f kafka.yaml

Extract ca-cert & my-user cert:

$ kubectl -n kafka get secret my-cluster-cluster-ca-cert -o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt

$ kubectl -n kafka get secret my-user -o jsonpath='{.data.user\.crt}' | base64 -d > user.crt
$ kubectl -n kafka get secret my-user -o jsonpath='{.data.user\.key}' | base64 -d > user.key

Create truststore & keystore (use any or no password):

$ keytool -keystore client.truststore.jks -alias CARoot -import -file ca.crt
$ openssl pkcs12 -export -in user.crt -inkey user.key -name my-user -password pass:password -out user.p12

Use the following configs when connecting to the cluster (use 443 port):

security.protocol=SSL
ssl.truststore.password=password #omit if none
ssl.truststore.location=./client.truststore.jks
ssl.keystore.password=password #omit if none
ssl.keystore.location=./user.p12
ssl.endpoint.identification.algorithm=

• Note that I have kafka operator listening on all namespaces

[tstromberg]

If there are any ingress experts in the house, it'd be wonderful to see a tutorial written up for this similar to:

https://minikube.sigs.k8s.io/docs/tutorials/nginx_tcp_udp_ingress/

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[Huskehhh]

If you find yourself in this situation, I was able to solve it with minikube via...

minikube kubectl -- patch deployment -n ingress-nginx ingress-nginx-controller -p='{"spec":{"template":{"spec":{"containers":[{"name":"controller","args":["/nginx-ingress-controller","--ingress-class=nginx","--configmap=$(POD_NAMESPACE)/ingress-nginx-controller","--report-node-internal-ip-address","--tcp-services-configmap=$(POD_NAMESPACE)/tcp-services","--udp-services-configmap=$(POD_NAMESPACE)/udp-services","--validating-webhook=:8443","--validating-webhook-certificate=/usr/local/certificates/cert","--validating-webhook-key=/usr/local/certificates/key","--enable-ssl-passthrough"]}]}}}}'

Which just patches the deployment of the ingress-nginx-controller with an extra argument --enable-ssl-passthrough.

It seems it also auto-redeploys after a patch, so it should pop back up fairly quick after the patch!

[christianh814]

I've done it using json type patching that's a little easier

kubectl patch deployment -n ingress-nginx ingress-nginx-controller --type='json' \
-p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--enable-ssl-passthrough"}]'

[etimoshenko]

You can just enable it from values.yaml

controller:
  extraArgs:
    "enable-ssl-passthrough": ""