Kubernetes-ingress: Error when getting nginx-ingress/default-server-secret

[ChristianJacobsen]

Describe the bug
I'm trying to get a K8S instance up and running on a fresh Fedora 28.0 running on a DigitalOcean Droplet. I use kubeadm to bootstrap the setup of K8S and my CNI of choice is Flannel. I've followed the instructions here to the letter as well as the install instructions for kubernetes-ingress. Afaik kubeadm sets up the cluster with RBAC by default, so unless there's something I need to alter in the rbac/rbac.yaml file I don't think that is the issue. I will provide the pod logs below. The pod just keeps going into CrashLoopBackOff while saying dial tcp 10.96.0.1:443: connect: no route to host.

P.S. kubeadm passes all preflight checks and this is a single-machine cluster (poor student).

To Reproduce
Steps to reproduce the behavior:

1. Provision a fresh k8s cluster with kubeadm and flannel CNI.
2. Follow the instructions in this document.
3. Run kubectl -n nginx-ingress logs <your pod name>
4. See the error

Expected behavior
An Ingress Controller that doesn't stay stuck in a crash loop

Your environment

• Version of the Ingress Controller - release version or a specific commit
  Latest edge build (1.3.0 as of now)
• Version of Kubernetes
  1.10.7
• Kubernetes platform (e.g. Mini-kube or GCP)
  DigitalOcean via kubeadm
• Using NGINX or NGINX Plus
  NGINX

Additional context

$ kubectl --namespace nginx-ingress logs nginx-ingress-89f96847c-skb4t
I0903 18:51:53.620553       1 main.go:105] Starting NGINX Ingress controller Version=edge GitCommit=9eb93252
F0903 18:51:54.691994       1 main.go:160] Error when getting nginx-ingress/default-server-secret: Get https://10.96.0.1:443/api/v1/namespaces/nginx-ingress/secrets/default-server-secret: dial tcp 10.96.0.1:443: connect: no route to host

[isaachawley]

Hi @ChristianJacobsen ,

That's the first call that the Ingress Controller makes to the Kubernetes API. The IC needs to be able to query the API in order to work.

There are some fix suggestions in this similar issue.

Thanks

[ChristianJacobsen]

Thanks for your fast reply @isaachawley!
It seems it was just my very strict iptables rules.
Do you happen to know which ports it needs open for it to work with iptables enabled?

Thanks in advance!

[isaachawley]

Hi @ChristianJacobsen ,

It looks like yours is trying to connect on 443, but it's not straightforward. We use the kubernetes go client lib, and it handles locating and authenticating to the api server. doc, example.

It looks like 443 is the standard for the API but maybe it depends on your configuration.

Thanks

[ChristianJacobsen]

@isaachawley

Okay, sweet!

[RyanAquino]

Hi, Do you happen to solve the problem?

I am currently encountering the issue.
with this result :

{code}
Starting NGINX Ingress controller Version=edge GitCommit=43385691
F0523 09:30:27.573784 1 main.go:261] Error trying to get the default server TLS secret nginx-ingress/default-server-secret: could not get nginx-ingress/default-server-secret: Get https://10.96.0.1:443/api/v1/namespaces/nginx-ingress/secrets/default-server-secret: dial tcp 10.96.0.1:443: i/o timeout
{code}

[ghost]

Hello @RyanAquino I have the same error that you have, you've discovered some possible solution for this problem, I have tried many steps but, I don't have any another idea.

[kunalpuriii]

@RyanAquino @brayan-arrieta @ChristianJacobsen Did you resolve this issue, i have same issue where
kubectl logs -n nginx-ingress nginx-ingress-57cdc75bdb-9kdrk
I0612 10:09:37.881819 1 main.go:169] Starting NGINX Ingress controller Version=1.6.3 GitCommit=b9378d56
F0612 10:10:07.889195 1 main.go:275] Error trying to get the default server TLS secret nginx-ingress/default-server-secret: could not get nginx-ingress/default-server-secret: Get https://192.168.209.1:443/api/v1/namespaces/nginx-ingress/secrets/default-server-secret: dial tcp 192.168.209.1:443: i/o timeout

[kunalpuriii]

@RyanAquino @brayan-arrieta @ChristianJacobsen Did you resolve this issue, i have same issue where
kubectl logs -n nginx-ingress nginx-ingress-57cdc75bdb-9kdrk
I0612 10:09:37.881819 1 main.go:169] Starting NGINX Ingress controller Version=1.6.3 GitCommit=b9378d56
F0612 10:10:07.889195 1 main.go:275] Error trying to get the default server TLS secret nginx-ingress/default-server-secret: could not get nginx-ingress/default-server-secret: Get https://192.168.209.1:443/api/v1/namespaces/nginx-ingress/secrets/default-server-secret: dial tcp 192.168.209.1:443: i/o timeout

[ChristianJacobsen]

@kunalpuriii sorry. I gave up on this project and went with a managed instance instead.

[RyanAquino]

Hi @kunalpuriii ,

I cannot remember well on how I did solved this problem. But I think i did something like setting the iptables if you are using linux to allow/accept

see here : https://serverfault.com/questions/140622/how-can-i-port-forward-with-iptables.

try running this command , this looks familiar to me : sysctl net.ipv4.ip_forward=1

let me know for any results.

Thanks

Regards,
Ryan