Ingress-nginx: 0.27.1 broken when running as non-root: "unexpected error storing fake SSL Cert"

[jtackaberry]

Installed 0.27.1 with runAsUser: 33 and I'm getting:

-------------------------------------------------------------------------------
NGINX Ingress controller
  Release:       0.27.1
  Build:         git-1257ded99
  Repository:    https://github.com/kubernetes/ingress-nginx
  nginx version: nginx/1.17.7

-------------------------------------------------------------------------------

I0127 02:24:49.891111       7 flags.go:205] Watching for Ingress class: nginx
W0127 02:24:49.891358       7 flags.go:250] SSL certificate chain completion is disabled (--enable-ssl-chain-completion=false)
W0127 02:24:49.891398       7 client_config.go:543] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
I0127 02:24:49.891500       7 main.go:194] Creating API client for https://10.152.183.1:443
I0127 02:24:49.895626       7 main.go:238] Running in Kubernetes cluster version v1.16 (v1.16.4) - git (clean) commit 224be7bdce5a9dd0c2fd0d46b83865648e2fe0ba - platform linux/amd64
F0127 02:24:49.996896       7 ssl.go:389] unexpected error storing fake SSL Cert: could not create PEM certificate file /etc/ingress-controller/ssl/default-fake-certificate.pem: open /etc/ingress-controller/ssl/default-fake-certificate.pem: permission denied

Pod spec securityContext specifically is:

          securityContext:
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
            # www-data -> 33
            runAsUser: 33

Reverting to 0.26.2 resolves.

[aledbf]

Closing. Please check the release notes https://github.com/kubernetes/ingress-nginx/releases/tag/nginx-0.27.1

[jtackaberry]

Ah, doh. Sorry for dropping the SNR.