{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/1549","repository_url":"https://api.github.com/repos/kubernetes/ingress-nginx","labels_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/1549/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/1549/comments","events_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/1549/events","html_url":"https://github.com/kubernetes/ingress-nginx/issues/1549","id":266760127,"number":1549,"title":"Ingress resource not matched by request","user":{"login":"cristic83","id":24541000,"avatar_url":"https://avatars3.githubusercontent.com/u/24541000?v=4","gravatar_id":"","url":"https://api.github.com/users/cristic83","html_url":"https://github.com/cristic83","followers_url":"https://api.github.com/users/cristic83/followers","following_url":"https://api.github.com/users/cristic83/following{/other_user}","gists_url":"https://api.github.com/users/cristic83/gists{/gist_id}","starred_url":"https://api.github.com/users/cristic83/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cristic83/subscriptions","organizations_url":"https://api.github.com/users/cristic83/orgs","repos_url":"https://api.github.com/users/cristic83/repos","events_url":"https://api.github.com/users/cristic83/events{/privacy}","received_events_url":"https://api.github.com/users/cristic83/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-10-19T08:28:58Z","updated_at":"2017-10-19T12:18:08Z","closed_at":"2017-10-19T12:18:08Z","author_association":"NONE","body":"**NGINX Ingress controller version**:\r\n\r\ngcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.15\r\n\r\n**Kubernetes version** (use `kubectl version`):\r\nopenshift v3.6.0+c4dd4cf\r\nkubernetes v1.6.1+5115d708d7\r\n**Environment**:\r\n\r\n- **Cloud provider or hardware configuration**: \r\nAWS\r\n- **OS** (e.g. from /etc/os-release):\r\n\r\nNAME=\"Red Hat Enterprise Linux Server\"\r\nVERSION=\"7.2 (Maipo)\"\r\n\r\n- **Kernel** (e.g. `uname -a`):\r\nx86_64 x86_64 x86_64 GNU/Linux\r\n\r\n- **Install tools**: Openshift origin v3.6\r\n- **Others**:\r\nWe've configured Opneshift to allow host ports on the daemonset :\r\noadm policy add-scc-to-user privileged system:serviceaccount:<namespace>:ingress\r\nand to allow the ningx controller to access the services:\r\noadm policy add-cluster-role-to-user cluster-admin system:serviceaccount:<namespace>:ingress\r\n\r\n**What happened**:\r\nSetting up the nginx ingress controller to handle ingress resources with TLS didn't work, as the requests are not matched against the ingress resource and nginx always returns 404 from the default backend.\r\nRunning the following curl command:\r\n\r\ncurl https://<namespace>.<server_name>.com/health\r\n\r\nwith the following content of the /etc/hosts: \r\n127.0.0.1   <namespace>.<server_name>.com\r\n\r\nfrom the master host of the K8s cluster produces the 404 endpoint.\r\n\r\nLogs are below:\r\n\r\n[ec2-user@ip-10-0-63-21 ~]$ oc logs -f nginx-ingress-lb-fv08s\r\nI1019 07:41:00.659355       7 launch.go:113] &{NGINX 0.9.0-beta.15 git-a3e86f2 https://github.com/kubernetes/ingress}\r\nI1019 07:41:00.659386       7 launch.go:116] Watching for ingress class: nginx\r\nI1019 07:41:00.659542       7 launch.go:291] Creating API client for https://172.30.0.1:443\r\nI1019 07:41:00.690602       7 launch.go:304] Running in Kubernetes Cluster version v1.6 (v1.6.1+5115d708d7) - git (clean) commit fff65cf - platform linux/amd64\r\nI1019 07:41:00.705751       7 launch.go:140] validated <namespace>/default-http-backend as the default backend\r\nI1019 07:41:00.715405       7 nginx.go:172] starting NGINX process...\r\nI1019 07:41:00.715830       7 controller.go:1206] starting Ingress controller\r\nI1019 07:41:00.722521       7 event.go:218] Event(v1.ObjectReference{Kind:\"Ingress\", Namespace:\"<namespace>\", Name:\"<server_name>-ingress\", UID:\"cb89e7dd-b4a0-11e7-8a32-0af3d4ff825a\", APIVersion:\"extensions\", ResourceVersion:\"1781\", FieldPath:\"\"}): type: 'Normal' reason: 'CREATE' Ingress <namespace>/<server_name>-ingress\r\nI1019 07:41:06.367480       7 controller.go:1214] running initial sync of secret\r\nI1019 07:41:06.391520       7 backend_ssl.go:64] adding secret <namespace>/<server_name>-tls-secret to the local store\r\nI1019 07:41:06.391599       7 leaderelection.go:174] attempting to acquire leader lease...\r\nW1019 07:41:06.391669       7 controller.go:471] service <namespace>/default-http-backend does not have any active endpoints\r\nI1019 07:41:06.398671       7 controller.go:304] backend reload required\r\nI1019 07:41:06.398865       7 metrics.go:34] changing prometheus collector from  to default\r\nI1019 07:41:06.401893       7 leaderelection.go:184] successfully acquired lease <namespace>/ingress-controller-leader-nginx\r\nI1019 07:41:06.401974       7 status.go:197] new leader elected: nginx-ingress-lb-fv08s\r\nI1019 07:41:06.498939       7 controller.go:313] ingress backend successfully reloaded...\r\nW1019 07:41:40.578127       7 controller.go:471] service <namespace>/default-http-backend does not have any active endpoints\r\nW1019 07:41:41.127626       7 controller.go:471] service <namespace>/default-http-backend does not have any active endpoints\r\nI1019 07:41:47.831417       7 controller.go:304] backend reload required\r\nI1019 07:41:47.894537       7 controller.go:313] ingress backend successfully reloaded...\r\nI1019 07:42:06.420037       7 status.go:362] updating Ingress <namespace>/<server_name>-ingress status to [{<HOST_IP> }]\r\nI1019 07:42:06.425109       7 event.go:218] Event(v1.ObjectReference{Kind:\"Ingress\", Namespace:\"<namespace>\", Name:\"<server_name>-ingress\", UID:\"cb89e7dd-b4a0-11e7-8a32-0af3d4ff825a\", APIVersion:\"extensions\", ResourceVersion:\"2197\", FieldPath:\"\"}): type: 'Normal' reason: 'UPDATE' Ingress <namespace>/<server_name>-ingress\r\n109.100.138.75 - [109.100.138.75] - - [19/Oct/2017:07:46:55 +0000] \"GET /health HTTP/1.0\" 404 21 \"-\" \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36\" 546 0.004 [upstream-default-backend] 10.129.0.6:8080 21 0.004 404\r\n127.0.0.1 - [127.0.0.1] - - [19/Oct/2017:07:47:09 +0000] \"GET /health HTTP/1.1\" 404 21 \"-\" \"curl/7.29.0\" 100 0.002 [upstream-default-backend] 10.129.0.6:8080 21 0.002 404\r\n127.0.0.1 - [127.0.0.1] - - [19/Oct/2017:07:47:13 +0000] \"GET /health HTTP/1.1\" 404 21 \"-\" \"curl/7.29.0\" 100 0.002 [upstream-default-backend] 10.129.0.6:8080 21 0.002 404\r\n127.0.0.1 - [127.0.0.1] - - [19/Oct/2017:07:47:14 +0000] \"GET /health HTTP/1.1\" 404 21 \"-\" \"curl/7.29.0\" 100 0.002 [upstream-default-backend] 10.129.0.6:8080 21 0.002 404\r\n127.0.0.1 - [127.0.0.1] - - [19/Oct/2017:07:47:15 +0000] \"GET /health HTTP/1.1\" 404 21 \"-\" \"curl/7.29.0\" 100 0.001 [upstream-default-backend] 10.129.0.6:8080 21 0.001 404\r\n127.0.0.1 - [127.0.0.1] - - [19/Oct/2017:07:48:55 +0000] \"GET /health HTTP/1.1\" 404 21 \"-\" \"curl/7.29.0\" 86 0.002 [upstream-default-backend] 10.129.0.6:8080 21 0.002 404\r\n127.0.0.1 - [127.0.0.1] - - [19/Oct/2017:07:48:59 +0000] \"GET /health HTTP/1.1\" 404 21 \"-\" \"curl/7.29.0\" 86 0.002 [upstream-default-backend] 10.129.0.6:8080 21 0.002 404\r\n127.0.0.1 - [127.0.0.1] - - [19/Oct/2017:07:49:00 +0000] \"GET /health HTTP/1.1\" 404 21 \"-\" \"curl/7.29.0\" 86 0.001 [upstream-default-backend] 10.129.0.6:8080 21 0.001 404\r\n127.0.0.1 - [127.0.0.1] - - [19/Oct/2017:07:49:10 +0000] \"GET /health HTTP/1.1\" 404 21 \"-\" \"curl/7.29.0\" 86 0.002 [upstream-default-backend] 10.129.0.6:8080 21 0.002 404\r\n127.0.0.1 - [127.0.0.1] - - [19/Oct/2017:07:49:11 +0000] \"GET /health HTTP/1.1\" 404 21 \"-\" \"curl/7.29.0\" 86 0.000 [upstream-default-backend] 10.129.0.6:8080 21 0.000 404\r\n127.0.0.1 - [127.0.0.1] - - [19/Oct/2017:07:49:12 +0000] \"GET /health HTTP/1.1\" 404 21 \"-\" \"curl/7.29.0\" 86 0.001 [upstream-default-backend] 10.129.0.6:8080 21 0.001 404\r\n\r\noc describe ingress <server_name>-ingress \r\n\r\nName:\t\t\t<server_name>-ingress\r\nNamespace:\t\t<namespace>\r\nDefault backend:\tdefault-http-backend:80 (<none>)\r\nTLS:\r\n  <server_name>-tls-secret terminates \r\n  SNI routes <namespace>.<server_name>.com\r\nRules:\r\n  Host\t\t\tPath\tBackends\r\n  ----\t\t\t----\t--------\r\n  <namespace>.<server_name>.com\t\r\n    \t\t\t/* \t<service_name>:<service_port> (<none>)\r\nAnnotations:\r\nEvents:\r\n  FirstSeen\tLastSeen\tCount\tFrom\t\t\tSubObjectPath\tType\t\tReason\tMessage\r\n  ---------\t--------\t-----\t----\t\t\t-------------\t--------\t------\t-------\r\n  15m\t\t15m\t\t1\tingress-controller\t\t\tNormal\t\tCREATE\tIngress <namespace>/<server_name>-ingress\r\n  14m\t\t14m\t\t1\tingress-controller\t\t\tNormal\t\tUPDATE\tIngress <namespace>/<server_name>-ingress\r\n[ec2-user@ip-10-0-63-21 ~]$ oc describe pod nginx-ingress-lb-fv08s \r\nName:\t\t\tnginx-ingress-lb-fv08s\r\nNamespace:\t\t<namespace>\r\nStart Time:\t\tThu, 19 Oct 2017 09:40:37 +0200\r\nLabels:\t\t\tname=nginx-ingress-lb\r\n\t\t\tpod-template-generation=1\r\nAnnotations:\t\tkubernetes.io/created-by={\"kind\":\"SerializedReference\",\"apiVersion\":\"v1\",\"reference\":{\"kind\":\"DaemonSet\",\"namespace\":\"<namespace>\",\"name\":\"nginx-ingress-lb\",\"uid\":\"cb88306d-b4a0-11e7-8a32-0af3d4ff825a\",\"apiV...\r\n\t\t\topenshift.io/scc=privileged\r\nStatus:\t\t\tRunning\r\nControllers:\t\tDaemonSet/nginx-ingress-lb\r\nContainers:\r\n  nginx-ingress-lb:\r\n    Container ID:\tdocker://942170edf523ba63b07b3a4e48b6aa6cd44890f2e7c5444b67f871ef4a62e155\r\n    Image:\t\tgcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.15\r\n    Image ID:\t\tdocker-pullable://gcr.io/google_containers/nginx-ingress-controller@sha256:1c64bc6dfb7ddbe4a0a9fce7f5c521aa13e7836c3b90601897b763add8494a41\r\n    Ports:\t\t80/TCP, 443/TCP\r\n    Args:\r\n      /nginx-ingress-controller\r\n      --default-backend-service=$(POD_NAMESPACE)/default-http-backend\r\n      --default-ssl-certificate=<namespace>/<server_name>-tls-secret\r\n    State:\t\tRunning\r\n      Started:\t\tThu, 19 Oct 2017 09:41:00 +0200\r\n    Ready:\t\tTrue\r\n    Restart Count:\t0\r\n    Liveness:\t\thttp-get http://:10254/healthz delay=10s timeout=1s period=10s #success=1 #failure=3\r\n    Readiness:\t\thttp-get http://:10254/healthz delay=0s timeout=1s period=10s #success=1 #failure=3\r\n    Environment:\r\n      POD_NAME:\t\tnginx-ingress-lb-fv08s (v1:metadata.name)\r\n      POD_NAMESPACE:\t<namespace> (v1:metadata.namespace)\r\n    Mounts:\r\n      /var/run/secrets/kubernetes.io/serviceaccount from ingress-token-1nh3t (ro)\r\nConditions:\r\n  Type\t\tStatus\r\n  Initialized \tTrue \r\n  Ready \tTrue \r\n  PodScheduled \tTrue \r\nVolumes:\r\n  ingress-token-1nh3t:\r\n    Type:\tSecret (a volume populated by a Secret)\r\n    SecretName:\tingress-token-1nh3t\r\n    Optional:\tfalse\r\nQoS Class:\tBestEffort\r\nNode-Selectors:\t<none>\r\nTolerations:\tnode.alpha.kubernetes.io/notReady=:Exists:NoExecute\r\n\t\tnode.alpha.kubernetes.io/unreachable=:Exists:NoExecute\r\n\r\ncat /etc/nginx/nginx.conf\r\n\r\ndaemon off;\r\n\r\nworker_processes 8;\r\npid /run/nginx.pid;\r\n\r\nworker_rlimit_nofile 130048;\r\nworker_shutdown_timeout 10s ;\r\n\r\nevents {\r\n    multi_accept        on;\r\n    worker_connections  16384;\r\n    use                 epoll;\r\n}\r\n\r\nhttp {\r\n    real_ip_header      X-Forwarded-For;\r\n\r\n    real_ip_recursive   on;\r\n    set_real_ip_from    0.0.0.0/0;\r\n\r\n    geoip_country       /etc/nginx/GeoIP.dat;\r\n    geoip_city          /etc/nginx/GeoLiteCity.dat;\r\n    geoip_proxy_recursive on;\r\n    sendfile            on;\r\n\r\n    aio                 threads;\r\n    aio_write           on;\r\n\r\n    tcp_nopush          on;\r\n    tcp_nodelay         on;\r\n\r\n    log_subrequest      on;\r\n\r\n    reset_timedout_connection on;\r\n\r\n    keepalive_timeout  75s;\r\n    keepalive_requests 100;\r\n\r\n    client_header_buffer_size       1k;\r\n    client_header_timeout           60s;\r\n    large_client_header_buffers     4 8k;\r\n    client_body_buffer_size         8k;\r\n    client_body_timeout             60s;\r\n\r\n    http2_max_field_size            4k;\r\n    http2_max_header_size           16k;\r\n\r\n    types_hash_max_size             2048;\r\n    server_names_hash_max_size      1024;\r\n    server_names_hash_bucket_size   64;\r\n    map_hash_bucket_size            64;\r\n\r\n    proxy_headers_hash_max_size     512;\r\n    proxy_headers_hash_bucket_size  64;\r\n\r\n    variables_hash_bucket_size      64;\r\n    variables_hash_max_size         2048;\r\n\r\n    underscores_in_headers          off;\r\n    ignore_invalid_headers          on;\r\n    include /etc/nginx/mime.types;\r\n    default_type text/html;\r\n    gzip on;\r\n    gzip_comp_level 5;\r\n    gzip_http_version 1.1;\r\n    gzip_min_length 256;\r\n    gzip_types application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component;\r\n    gzip_proxied any;\r\n\r\n    # Custom headers for response\r\n\r\n    server_tokens on;\r\n\r\n    # disable warnings\r\n    uninitialized_variable_warn off;\r\n\r\n    # Additional available variables:\r\n    # $namespace\r\n    # $ingress_name\r\n    # $service_name\r\n    log_format upstreaminfo '$the_real_ip - [$the_real_ip] - $remote_user [$time_local] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\" $request_length $request_time [$proxy_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status';\r\n\r\n    map $request_uri $loggable {\r\n        default 1;\r\n    }\r\n\r\n    access_log /var/log/nginx/access.log upstreaminfo if=$loggable;\r\n    error_log  /var/log/nginx/error.log notice;\r\n\r\n    resolver <HOST_IP> valid=30s;\r\n\r\n    # Retain the default nginx handling of requests without a \"Connection\" header\r\n    map $http_upgrade $connection_upgrade {\r\n        default          upgrade;\r\n        ''               close;\r\n    }\r\n\r\n    map $http_x_forwarded_for $the_real_ip {\r\n        default          $remote_addr;\r\n    }\r\n\r\n    # trust http_x_forwarded_proto headers correctly indicate ssl offloading\r\n    map $http_x_forwarded_proto $pass_access_scheme {\r\n        default          $http_x_forwarded_proto;\r\n        ''               $scheme;\r\n    }\r\n\r\n    map $http_x_forwarded_port $pass_server_port {\r\n        default           $http_x_forwarded_port;\r\n        ''                $server_port;\r\n    }\r\n\r\n    map $http_x_forwarded_host $best_http_host {\r\n        default          $http_x_forwarded_host;\r\n        ''               $this_host;\r\n    }\r\n\r\n    map $pass_server_port $pass_port {\r\n        443              443;\r\n        default          $pass_server_port;\r\n    }\r\n\r\n    # Obtain best http host\r\n    map $http_host $this_host {\r\n        default          $http_host;\r\n        ''               $host;\r\n    }\r\n\r\n    server_name_in_redirect off;\r\n    port_in_redirect        off;\r\n\r\n    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;\r\n\r\n    # turn on session caching to drastically improve performance\r\n    ssl_session_cache builtin:1000 shared:SSL:10m;\r\n    ssl_session_timeout 10m;\r\n\r\n    # allow configuring ssl session tickets\r\n    ssl_session_tickets on;\r\n\r\n    # slightly reduce the time-to-first-byte\r\n    ssl_buffer_size 4k;\r\n\r\n    # allow configuring custom ssl ciphers\r\n    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';\r\n    ssl_prefer_server_ciphers on;\r\n\r\n    ssl_ecdh_curve auto;\r\n\r\n    proxy_ssl_session_reuse on;\r\n\r\n    upstream upstream-default-backend {\r\n        # Load balance algorithm; empty for round robin, which is the default\r\n        least_conn;\r\n\r\n        keepalive 32;\r\n\r\n        server 10.129.0.6:8080 max_fails=0 fail_timeout=0;\r\n    }\r\n    server {\r\n        server_name _;\r\n        listen 80 default_server reuseport backlog=511;\r\n        listen [::]:80 default_server reuseport backlog=511;\r\n        set $proxy_upstream_name \"-\";\r\n\r\n        listen 443  default_server reuseport backlog=511 ssl http2;\r\n        listen [::]:443  default_server reuseport backlog=511 ssl http2;\r\n        # PEM sha: ed0f1ee931fe1145bee296bfe763b3955bd07777\r\n        ssl_certificate                         /ingress-controller/ssl/<namespace>-<server_name>-tls-secret.pem;\r\n        ssl_certificate_key                     /ingress-controller/ssl/<namespace>-<server_name>-tls-secret.pem;\r\n\r\n        more_set_headers                        \"Strict-Transport-Security: max-age=15724800; includeSubDomains;\";\r\n\r\n        location / {\r\n\r\n            set $proxy_upstream_name \"upstream-default-backend\";\r\n\r\n            set $namespace      \"\";\r\n            set $ingress_name   \"\";\r\n            set $service_name   \"\";\r\n\r\n            port_in_redirect off;\r\n\r\n            client_max_body_size                    \"1m\";\r\n\r\n            proxy_set_header Host                   $best_http_host;\r\n            # Pass the extracted client certificate to the backend\r\n\r\n            # Allow websocket connections\r\n            proxy_set_header                        Upgrade           $http_upgrade;\r\n            proxy_set_header                        Connection        $connection_upgrade;\r\n\r\n            proxy_set_header X-Real-IP              $the_real_ip;\r\n            proxy_set_header X-Forwarded-For        $the_real_ip;\r\n            proxy_set_header X-Forwarded-Host       $best_http_host;\r\n            proxy_set_header X-Forwarded-Port       $pass_port;\r\n            proxy_set_header X-Forwarded-Proto      $pass_access_scheme;\r\n            proxy_set_header X-Original-URI         $request_uri;\r\n            proxy_set_header X-Scheme               $pass_access_scheme;\r\n\r\n            # Pass the original X-Forwarded-For\r\n            proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;\r\n\r\n            # mitigate HTTPoxy Vulnerability\r\n            # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/\r\n            proxy_set_header Proxy                  \"\";\r\n\r\n            # Custom headers to proxied server\r\n\r\n            proxy_connect_timeout                   5s;\r\n            proxy_send_timeout                      60s;\r\n            proxy_read_timeout                      60s;\r\n\r\n            proxy_redirect                          off;\r\n            proxy_buffering                         off;\r\n            proxy_buffer_size                       \"4k\";\r\n            proxy_buffers                           4 \"4k\";\r\n            proxy_request_buffering                 \"on\";\r\n\r\n            proxy_http_version                      1.1;\r\n\r\n            proxy_cookie_domain                     off;\r\n            proxy_cookie_path                       off;\r\n\r\n            # In case of errors try the next upstream server before returning an error\r\n            proxy_next_upstream                     error timeout invalid_header http_502 http_503 http_504;\r\n\r\n            proxy_pass http://upstream-default-backend;\r\n        }\r\n\r\n        # health checks in cloud providers require the use of port 80\r\n        location /healthz {\r\n            access_log off;\r\n            return 200;\r\n        }\r\n\r\n        # this is required to avoid error if nginx is being monitored\r\n        # with an external software (like sysdig)\r\n        location /nginx_status {\r\n            allow 127.0.0.1;\r\n            allow ::1;\r\n            deny all;\r\n\r\n            access_log off;\r\n            stub_status on;\r\n        }\r\n    }\r\n    server {\r\n        server_name <namespace>.<server_name>.com;\r\n        listen 80;\r\n        listen [::]:80;\r\n        set $proxy_upstream_name \"-\";\r\n\r\n        listen 443  ssl http2;\r\n        listen [::]:443  ssl http2;\r\n        # PEM sha: ed0f1ee931fe1145bee296bfe763b3955bd07777\r\n        ssl_certificate                         /ingress-controller/ssl/<namespace>-<server_name>-tls-secret.pem;\r\n        ssl_certificate_key                     /ingress-controller/ssl/<namespace>-<server_name>-tls-secret.pem;\r\n\r\n        more_set_headers                        \"Strict-Transport-Security: max-age=15724800; includeSubDomains;\";\r\n\r\n        location /* {\r\n\r\n            set $proxy_upstream_name \"upstream-default-backend\";\r\n\r\n            set $namespace      \"<namespace>\";\r\n            set $ingress_name   \"<server_name>-ingress\";\r\n            set $service_name   \"<service_name>\";\r\n\r\n            # enforce ssl on server side\r\n            if ($pass_access_scheme = http) {\r\n                return 301 https://$best_http_host$request_uri;\r\n            }\r\n            port_in_redirect off;\r\n\r\n            client_max_body_size                    \"1m\";\r\n\r\n            proxy_set_header Host                   $best_http_host;\r\n            # Pass the extracted client certificate to the backend\r\n\r\n            # Allow websocket connections\r\n            proxy_set_header                        Upgrade           $http_upgrade;\r\n            proxy_set_header                        Connection        $connection_upgrade;\r\n\r\n            proxy_set_header X-Real-IP              $the_real_ip;\r\n            proxy_set_header X-Forwarded-For        $the_real_ip;\r\n            proxy_set_header X-Forwarded-Host       $best_http_host;\r\n            proxy_set_header X-Forwarded-Port       $pass_port;\r\n            proxy_set_header X-Forwarded-Proto      $pass_access_scheme;\r\n            proxy_set_header X-Original-URI         $request_uri;\r\n            proxy_set_header X-Scheme               $pass_access_scheme;\r\n\r\n            # Pass the original X-Forwarded-For\r\n            proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;\r\n\r\n            # mitigate HTTPoxy Vulnerability\r\n            # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/\r\n            proxy_set_header Proxy                  \"\";\r\n\r\n            # Custom headers to proxied server\r\n\r\n            proxy_connect_timeout                   5s;\r\n            proxy_send_timeout                      60s;\r\n            proxy_read_timeout                      60s;\r\n\r\n            proxy_redirect                          off;\r\n            proxy_buffering                         off;\r\n            proxy_buffer_size                       \"4k\";\r\n            proxy_buffers                           4 \"4k\";\r\n            proxy_request_buffering                 \"on\";\r\n\r\n            proxy_http_version                      1.1;\r\n\r\n            proxy_cookie_domain                     off;\r\n            proxy_cookie_path                       off;\r\n\r\n            # In case of errors try the next upstream server before returning an error\r\n            proxy_next_upstream                     error timeout invalid_header http_502 http_503 http_504;\r\n\r\n            proxy_pass http://upstream-default-backend;\r\n        }\r\n        location / {\r\n\r\n            set $proxy_upstream_name \"upstream-default-backend\";\r\n\r\n            set $namespace      \"\";\r\n            set $ingress_name   \"\";\r\n            set $service_name   \"\";\r\n\r\n            port_in_redirect off;\r\n\r\n            client_max_body_size                    \"1m\";\r\n\r\n            proxy_set_header Host                   $best_http_host;\r\n            # Pass the extracted client certificate to the backend\r\n\r\n            # Allow websocket connections\r\n            proxy_set_header                        Upgrade           $http_upgrade;\r\n            proxy_set_header                        Connection        $connection_upgrade;\r\n\r\n            proxy_set_header X-Real-IP              $the_real_ip;\r\n            proxy_set_header X-Forwarded-For        $the_real_ip;\r\n            proxy_set_header X-Forwarded-Host       $best_http_host;\r\n            proxy_set_header X-Forwarded-Port       $pass_port;\r\n            proxy_set_header X-Forwarded-Proto      $pass_access_scheme;\r\n            proxy_set_header X-Original-URI         $request_uri;\r\n            proxy_set_header X-Scheme               $pass_access_scheme;\r\n\r\n            # Pass the original X-Forwarded-For\r\n            proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;\r\n\r\n            # mitigate HTTPoxy Vulnerability\r\n            # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/\r\n            proxy_set_header Proxy                  \"\";\r\n\r\n            # Custom headers to proxied server\r\n\r\n            proxy_connect_timeout                   5s;\r\n            proxy_send_timeout                      60s;\r\n            proxy_read_timeout                      60s;\r\n\r\n            proxy_redirect                          off;\r\n            proxy_buffering                         off;\r\n            proxy_buffer_size                       \"4k\";\r\n            proxy_buffers                           4 \"4k\";\r\n            proxy_request_buffering                 \"on\";\r\n\r\n            proxy_http_version                      1.1;\r\n\r\n            proxy_cookie_domain                     off;\r\n            proxy_cookie_path                       off;\r\n\r\n            # In case of errors try the next upstream server before returning an error\r\n            proxy_next_upstream                     error timeout invalid_header http_502 http_503 http_504;\r\n\r\n            proxy_pass http://upstream-default-backend;\r\n        }\r\n    }\r\n    # default server, used for NGINX healthcheck and access to nginx stats\r\n    server {\r\n        # Use the port 18080 (random value just to avoid known ports) as default port for nginx.\r\n        # Changing this value requires a change in:\r\n        # https://github.com/kubernetes/ingress/blob/master/controllers/nginx/pkg/cmd/controller/nginx.go\r\n        listen 18080 default_server reuseport backlog=511;\r\n        listen [::]:18080 default_server reuseport backlog=511;\r\n        set $proxy_upstream_name \"-\";\r\n\r\n        location /healthz {\r\n            access_log off;\r\n            return 200;\r\n        }\r\n\r\n        location /nginx_status {\r\n            set $proxy_upstream_name \"internal\";\r\n\r\n            access_log off;\r\n            stub_status on;\r\n        }\r\n\r\n        location / {\r\n            set $proxy_upstream_name \"upstream-default-backend\";\r\n            proxy_pass          http://upstream-default-backend;\r\n        }\r\n    }\r\n}\r\n\r\nstream {\r\n    log_format log_stream [$time_local] $protocol $status $bytes_sent $bytes_received $session_time;\r\n\r\n    access_log /var/log/nginx/access.log log_stream;\r\n\r\n    error_log  /var/log/nginx/error.log;\r\n\r\n    # TCP services\r\n\r\n    # UDP services\r\n}\r\n\r\n\r\n**What you expected to happen**:\r\n\r\nWe'd have expected the request to be forwarded to the configured service.\r\n\r\n**How to reproduce it** (as minimally and precisely as possible):\r\n\r\nThe yaml files of the ingress resource is below:\r\n```yaml\r\napiVersion: extensions/v1beta1\r\nkind: Ingress\r\nmetadata:\r\n  name: <server_name>-ingress\r\n  namespace: <namespace>\r\n  annotations:\r\n    kubernetes.io/ingress.class: \"nginx\"\r\nspec:\r\n  tls:\r\n  - secretName: <server_name>-tls-secret\r\n  - hosts:\r\n    - <namespace>.<server_name>.com\r\n  rules:\r\n  - host: <namespace>.<server_name>.com\r\n    http:\r\n      paths:\r\n      - backend:\r\n          serviceName: <service_name>\r\n          servicePort: <service_port>\r\n        path: /*\r\n```\r\nThe yaml of the ingress controller:\r\n```yaml\r\napiVersion: extensions/v1beta1\r\nkind: DaemonSet\r\nmetadata:\r\n  name: nginx-ingress-lb\r\n  labels:\r\n    name: nginx-ingress-lb\r\n  namespace: <namespace>\r\nspec:\r\n  template:\r\n    metadata:\r\n      labels:\r\n        name: nginx-ingress-lb\r\n    spec:\r\n      # hostNetwork makes it possible to use ipv6 and to preserve the source IP correctly regardless of docker configuration\r\n      # however, it is not a hard dependency of the nginx-ingress-controller itself and it may cause issues if port 10254 already is taken on the host\r\n      # that said, since hostPort is broken on CNI (https://github.com/kubernetes/kubernetes/issues/31307) we have to use hostNetwork where CNI is used\r\n      # like with kubeadm\r\n      hostNetwork: true\r\n      serviceAccountName: ingress\r\n      terminationGracePeriodSeconds: 60\r\n      containers:\r\n      - image: gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.15\r\n        name: nginx-ingress-lb\r\n        readinessProbe:\r\n          httpGet:\r\n            path: /healthz\r\n            port: 10254\r\n            scheme: HTTP\r\n        livenessProbe:\r\n          httpGet:\r\n            path: /healthz\r\n            port: 10254\r\n            scheme: HTTP\r\n          initialDelaySeconds: 10\r\n          timeoutSeconds: 1\r\n        ports:\r\n        - containerPort: 80\r\n          hostPort: 80\r\n        - containerPort: 443\r\n          hostPort: 443\r\n        env:\r\n          - name: POD_NAME\r\n            valueFrom:\r\n              fieldRef:\r\n                fieldPath: metadata.name\r\n          - name: POD_NAMESPACE\r\n            valueFrom:\r\n              fieldRef:\r\n                fieldPath: metadata.namespace\r\n        args:\r\n        - /nginx-ingress-controller\r\n        - --default-backend-service=$(POD_NAMESPACE)/default-http-backend\r\n        - --default-ssl-certificate=<namespace>/<server_name>-tls-secret\r\n```\r\nThe yaml of the backend service:\r\n\r\n```yaml\r\napiVersion: extensions/v1beta1\r\nkind: Deployment\r\nmetadata:\r\n  name: default-http-backend\r\n  labels:\r\n    k8s-app: default-http-backend\r\n  namespace: <namespace>\r\nspec:\r\n  replicas: 1\r\n  template:\r\n    metadata:\r\n      labels:\r\n        k8s-app: default-http-backend\r\n    spec:\r\n      terminationGracePeriodSeconds: 60\r\n      containers:\r\n      - name: default-http-backend\r\n        # Any image is permissable as long as:\r\n        # 1. It serves a 404 page at /\r\n        # 2. It serves 200 on a /healthz endpoint\r\n        image: gcr.io/google_containers/defaultbackend:1.0\r\n        livenessProbe:\r\n          httpGet:\r\n            path: /healthz\r\n            port: 8080\r\n            scheme: HTTP\r\n          initialDelaySeconds: 30\r\n          timeoutSeconds: 5\r\n        ports:\r\n        - containerPort: 8080\r\n        resources:\r\n          limits:\r\n            cpu: 10m\r\n            memory: 20Mi\r\n          requests:\r\n            cpu: 10m\r\n            memory: 20Mi\r\n---\r\napiVersion: v1\r\nkind: Service\r\nmetadata:\r\n  name: default-http-backend\r\n  namespace: <namespace>\r\n  labels:\r\n    k8s-app: default-http-backend\r\nspec:\r\n  ports:\r\n  - port: 80\r\n    targetPort: 8080\r\n  selector:\r\n    k8s-app: default-http-backend\r\n```\r\nThe yaml of the nginx service account:\r\n```yaml\r\n---\r\napiVersion: v1\r\nkind: ServiceAccount\r\nmetadata:\r\n  name: ingress\r\n  namespace: <namespace>\r\n```\r\nThe tls secret config:\r\n\r\noc describe secret <server_name>-tls-secret \r\nName:\t\t<server_name>-tls-secret\r\nNamespace:\t<namespace>\r\nLabels:\t\t<none>\r\n\r\nType:\tkubernetes.io/tls\r\n\r\nData\r\n====\r\ntls.key:\t1849 bytes\r\ntls.crt:\t7528 bytes\r\n\r\nThe SSL certificate is configured to match *.<server_name>.com.\r\n\r\n**Anything else we need to know**:\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/comments/337889830","html_url":"https://github.com/kubernetes/ingress-nginx/issues/1549#issuecomment-337889830","issue_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/1549","id":337889830,"user":{"login":"aledbf","id":161571,"avatar_url":"https://avatars2.githubusercontent.com/u/161571?v=4","gravatar_id":"","url":"https://api.github.com/users/aledbf","html_url":"https://github.com/aledbf","followers_url":"https://api.github.com/users/aledbf/followers","following_url":"https://api.github.com/users/aledbf/following{/other_user}","gists_url":"https://api.github.com/users/aledbf/gists{/gist_id}","starred_url":"https://api.github.com/users/aledbf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aledbf/subscriptions","organizations_url":"https://api.github.com/users/aledbf/orgs","repos_url":"https://api.github.com/users/aledbf/repos","events_url":"https://api.github.com/users/aledbf/events{/privacy}","received_events_url":"https://api.github.com/users/aledbf/received_events","type":"User","site_admin":false},"created_at":"2017-10-19T12:18:08Z","updated_at":"2017-10-19T12:18:08Z","author_association":"MEMBER","body":"Closing. Please change `path: /*` to `path: /`"}}
{"actor":{"display_login":"aledbf"}}