From 368ff060a21904a63ba3bae18f7cd710ade647ff Mon Sep 17 00:00:00 2001 From: Naeel Date: Tue, 21 Apr 2026 07:56:06 +0300 Subject: [PATCH] fix(ingress): remove cert-manager + ssl-redirect, TLS is external MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The platform (185.247.187.147) terminates TLS externally before nginx. HTTP-01 ACME challenge was stuck for 8 days because the platform globally redirects HTTP→HTTPS before reaching nginx ingress. Changes: - Remove cert-manager.io/cluster-issuer: letsencrypt-prod annotation - Remove tls section (iot-kube5s-ru-tls secret was never created) - Set ssl-redirect: false (TLS termination is at the edge, not nginx) - Update comment to document the actual TLS architecture --- deployments/k8s/emqx-ws-ingress.yaml | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/deployments/k8s/emqx-ws-ingress.yaml b/deployments/k8s/emqx-ws-ingress.yaml index aa49cfe..2ac0240 100644 --- a/deployments/k8s/emqx-ws-ingress.yaml +++ b/deployments/k8s/emqx-ws-ingress.yaml @@ -7,7 +7,9 @@ # IoT Консоль (UI): https://iot.kube5s.ru/console # # DNS A-запись: iot.kube5s.ru → 185.247.187.147 -# TLS: cert-manager + letsencrypt-prod, secret=iot-kube5s-ru-tls +# TLS: терминируется внешним слоем платформы (185.247.187.147). +# cert-manager НЕ используется — HTTP-01 challenge недоступен т.к. платформа +# глобально редиректит HTTP→HTTPS до nginx. # # Применение: kubectl apply -f deployments/k8s/emqx-ws-ingress.yaml @@ -34,18 +36,13 @@ metadata: namespace: sless annotations: kubernetes.io/ingress.class: nginx - cert-manager.io/cluster-issuer: letsencrypt-prod - nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/ssl-redirect: "false" # WebSocket: nginx-ingress добавляет Upgrade/Connection при proxy-http-version=1.1 nginx.ingress.kubernetes.io/proxy-http-version: "1.1" nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" nginx.ingress.kubernetes.io/proxy-send-timeout: "3600" spec: ingressClassName: nginx - tls: - - hosts: - - iot.kube5s.ru - secretName: iot-kube5s-ru-tls rules: - host: iot.kube5s.ru http: