1

What I'm trying to do

I'm trying to get the Nginx controller up and running on my kubernetes cluster with the NLB version of the config files.

The problem

The ingress-nginx-admission-create and ingress-nginx-admission-patch jobs immediately fail and do not create the ingress-nginx-admission secret that the deployment needs to mount a cert and key.

Details

logs from the ingress-nginx-admission-create job

W0603 17:59:17.907729       1 client_config.go:608] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
W0603 17:59:17.907803       1 client_config.go:613] error creating inClusterConfig, falling back to default config: open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory
{"error":"invalid configuration: no configuration has been provided, try setting KUBERNETES_MASTER environment variable","level":"fatal","msg":"error building kubernetes config","source":"k8s/k8s.go:21","time":"2021-06-03T17:59:17Z"}

logs from the ingress-nginx-admission-patch job

0603 17:59:18.990027       1 client_config.go:608] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
W0603 17:59:18.990093      1 client_config.go:613] error creating inClusterConfig, falling back to default config: open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory
{"error":"invalid configuration: no configuration has been provided, try setting KUBERNETES_MASTER environment variable","level":"fatal","msg":"error building kubernetes config","source":"k8s/k8s.go:21","time":"2021-06-03T17:59:18Z"}

Essentially the same as the create job.

describing the deployment's pod

Events:
  Type     Reason       Age                   From               Message
  ----     ------       ----                  ----               -------
  Normal   Scheduled    4m56s                 default-scheduler  Successfully assigned ingress-nginx/ingress-nginx-controller-59b98554fb-8bp6t to ip-172-31-47-215.us-west-2.compute.internal
  Warning  FailedMount  47s (x10 over 4m57s)  kubelet            MountVolume.SetUp failed for volume "webhook-cert" : secret "ingress-nginx-admission" not found
  Warning  FailedMount  38s (x2 over 2m54s)   kubelet            Unable to attach or mount volumes: unmounted volumes=[webhook-cert], unattached volumes=[webhook-cert]: timed out waiting for the condition

potentially useful information

I saw on other sources that I should try deleting the ValidatingWebhookConfiguration and recreate the jobs and deployment--that didn't work and I got the same logs/results. I tried creating a secret with empty secrets prior to the jobs running but that resulted in basically the same thing. The deployment was actually able to get going (in a way) but it didn't have the certificate or key from the jobs.

My question

Why aren't the jobs creating the secret? Is there something I need to modify?

4
  • Is this a fresh setup?
    – Samit
    Jun 3 at 18:15
  • Not exactly sure what you mean, but if I had to guess, I'd say no. I'm installing this on a cluster where I have the GitLab Helm chart installed which comes with its own Nginx. However, that Nginx controller is in a different namespace. Jun 3 at 19:00
  • discuss.kubernetes.io/t/nginx-ingress-install-failure/5379 Check this out, this could be the reason.
    – Samit
    Jun 3 at 19:18
  • @Samit YES!!! That was it! I had to add automount_service_account_token = true (terraform syntax, it'll be camel-cased in k8s) to the pod spec in both of my jobs. I also added it to the pod spec in the deployment but I'm not absolutely sure if that's needed. Go ahead and put that down in the answer if you want. Thank you so much. Jun 3 at 19:36
1

Set automountServiceAccountToken: true in your pod specification in both of the jobs and the deployment.

Ref: https://discuss.kubernetes.io/t/nginx-ingress-install-failure/5379/4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.