Multiple Ingresses on same host url, with different paths?

[LarsKumbier]

Describe the bug:
I have two ingress definitions in the same namespace and with the same hostname, but with different paths. The ingresses are routing to different services (think: frontend under example.com/ and example.com/api/).

I am missing a documentation on how to handle a case like this. If both ingresses have their own secret to save the certificate tls, cert-manager runs havoc and exhausts the ACME limit very quickly.

If both ingresses share one secret to save the certificate in, it seems to run, but the cert-manager logs show some errors:

I1214 18:55:25.947036       1 conditions.go:173] Setting lastTransitionTime for Certificate "cert-tls" condition "Ready" to 2020-12-14 18:55:25.947028747 +0000 UTC m=+1127.867979504
I1214 18:55:25.947085       1 conditions.go:173] Setting lastTransitionTime for Certificate "cert-tls" condition "Issuing" to 2020-12-14 18:55:25.947081 +0000 UTC m=+1127.868031736
E1214 18:55:25.954034       1 controller.go:158] cert-manager/controller/CertificateReadiness "msg"="re-queuing item due to error processing" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"cert-tls\": the object has been modified; please apply your changes to the latest version and try again" "key"="myapp/cert-tls" 
I1214 18:55:25.954073       1 conditions.go:173] Setting lastTransitionTime for Certificate "cert-tls" condition "Ready" to 2020-12-14 18:55:25.954068193 +0000 UTC m=+1127.875018941
I1214 18:55:26.730254       1 sync.go:178] cert-manager/controller/ingress-shim "msg"="certificate resource is not owned by this ingress. refusing to update non-owned certificate resource for ingress" "related_resource_kind"="Certificate" "related_resource_name"="cert-tls" "related_resource_namespace"="myapp" "related_resource_version"="v1" "resource_kind"="Ingress" "resource_name"="frontend" "resource_namespace"="myapp" "resource_version"="v1beta1" 
E1214 18:55:26.768348       1 controller.go:158] cert-manager/controller/CertificateKeyManager "msg"="re-queuing item due to error processing" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"cert-tls\": the object has been modified; please apply your changes to the latest version and try again" "key"="myapp/cert-tls" 
I1214 18:55:26.794538       1 conditions.go:233] Setting lastTransitionTime for CertificateRequest "cert-tls-lkg7w" condition "Ready" to 2020-12-14 18:55:26.794528732 +0000 UTC m=+1128.715479482
I1214 18:55:29.221015       1 acme.go:184] cert-manager/controller/certificaterequests-issuer-acme/sign "msg"="certificate issued" "related_resource_kind"="Order" "related_resource_name"="cert-tls-lkg7w-3431241695" "related_resource_namespace"="myapp" "related_resource_version"="v1" "resource_kind"="CertificateRequest" "resource_name"="cert-tls-lkg7w" "resource_namespace"="myapp" "resource_version"="v1" 
I1214 18:55:29.221208       1 conditions.go:222] Found status change for CertificateRequest "cert-tls-lkg7w" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2020-12-14 18:55:29.221202004 +0000 UTC m=+1131.142152752
I1214 18:55:29.239588       1 conditions.go:162] Found status change for Certificate "cert-tls" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2020-12-14 18:55:29.239578919 +0000 UTC m=+1131.160529674
E1214 18:55:29.244794       1 controller.go:158] cert-manager/controller/CertificateReadiness "msg"="re-queuing item due to error processing" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"cert-tls\": the object has been modified; please apply your changes to the latest version and try again" "key"="myapp/cert-tls" 
I1214 18:55:29.245124       1 conditions.go:162] Found status change for Certificate "cert-tls" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2020-12-14 18:55:29.245120496 +0000 UTC m=+1131.166071238
E1214 18:55:29.248057       1 controller.go:158] cert-manager/controller/CertificateIssuing "msg"="re-queuing item due to error processing" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"cert-tls\": the object has been modified; please apply your changes to the latest version and try again" "key"="myapp/cert-tls" 
E1214 18:55:29.250524       1 controller.go:158] cert-manager/controller/CertificateReadiness "msg"="re-queuing item due to error processing" "error"="Operation cannot be fulfilled on certificates.cert-manager.io \"cert-tls\": the object has been modified; please apply your changes to the latest version and try again" "key"="myapp/cert-tls" 
I1214 18:55:29.250917       1 conditions.go:162] Found status change for Certificate "cert-tls" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2020-12-14 18:55:29.25091106 +0000 UTC m=+1131.171861798

cert-tls is the secret name in this case.

While it seems to run, I did not find any documentation on this usecase, which I believe to be very common.

Steps to reproduce the bug:

(1) Install cert-manager on kubernetes via regular manifests
(2) deploy the ACME-staging clusterissuer
(3) deploy two ingresses:

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: backend
  namespace: myapp
  labels:
    app: backend
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "acme-staging"
spec:
  tls:
  - hosts:
    - myapp.example.com
    secretName: cert-tls
  rules:
    - host: myapp.example.com
      http:
        paths:
        - path: /api
          backend:
            serviceName: backend
            servicePort: 8000
-----
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: frontend
  namespace: myapp
  labels:
    app: frontend
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "acme-staging"
spec:
  tls:
  - hosts:
    - myapp.example.com
    secretName: cert-tls
  rules:
    - host: myapp.example.com
      http:
        paths:
        - path: /
          backend:
            serviceName: frontend
            servicePort: 3000

Anything else we need to know?:

Environment details::

• Kubernetes version: 1.17
• Cloud-provider/provisioner: microk8s
• cert-manager version: 1.1.0
• Install method: static manifests

/kind bug

[meyskens]

You just need to set cert-manager.io/cluster-issuer on one of the two ingresses so it will request the certificate, if they both point at the same secret name your ingress controller will know which certificate to use

[LarsKumbier]

Hey Maartje,
that won't work for me, because then I would have to deploy both together, always - which is exactly the kind of dependency I would like to get around.

[iyuroch]

you can try to add certificate separately, remove annotations on your ingresses altogether and specify secretName.
same can work if your ingress controller support default ssl/tls certificate