Kubectl tls patch returning “not patched”

user_13859314 0
Viewed 248

I am trying to patch istio-ingressgateway service with ACM by the following


kubectl -n istio-system patch service istio-ingressgateway -p "$(cat<<EOF
metadata:
  name: istio-ingressgateway
  namespace: istio-system
annotations:
service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:xx-xxxx-1:123456789:certificate/xxxx-xxx-xxxxxxxxxxx"
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "tcp"
service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
service.beta.kubernetes.io/aws-load-balancer-internal: "true"
service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
spec:
  type: LoadBalancer
  externalTrafficPolicy: Cluster
  selector:
    app: istio-ingressgateway
    istio: ingressgateway
EOF
)"

but it is returning not patched. Whats wrong here?

istio kubernetes amazon-web-services ssl
2 Answers

The problem is the indentation try to put your patch on a yaml file:

ingress_patch.yaml

metadata:
  name: istio-ingressgateway
  namespace: istio-system
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:xx-xxxx-1:123456789:certificate/xxxx-xxx-xxxxxxxxxxx"
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "tcp"
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
    service.beta.kubernetes.io/aws-load-balancer-internal: "true"
    service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
spec:
  type: LoadBalancer
  externalTrafficPolicy: Cluster
  selector:
    app: istio-ingressgateway
    istio: ingressgateway

Then apply it as follows:

kubectl -n istio-system patch service istio-ingressgateway -p "$(cat ./ingress_patch.yaml)"
user_16679910

I am posting this as a community wiki answer for better visibility.

As I mentioned in comments there is related github issue about Istio Ingress TLS key management use ACM.

Despite what @wolmi said what is true, because the indentation was wrong, there are more issues which need to be covered when you're trying to combine istio with ELB and ACM.

It's well described in 3 below answers.

Especially worth to take look and 3 below comments from above github issue.

  • Answer provided by @cmcconnell1.
  • Answer provided by @eduardobaitello
  • Answer provided by @eduardobaitello

Additionally there is a thread about that on discuss.istio.io

user_119777600
Related