Get 404 when install EJBCA with microk8s

[quyen66]

I'm installing EJBCA with this tutorial https://doc.primekey.com/ejbca/tutorials-and-guides/tutorial-deploy-ejbca-container-in-microk8s. But when I access the broswer return me 404. I'm running it with my VMware Ubuntu 20.04. Does anyone know why?

[primetomas]

Which step in the tutorial are you on when you get this?
And what is the URL you use to access EJBCA (giving the 404)?

[quyen66]

After all step, I access by the IP instead of adding host in /etc/hosts file.

I checked everything is working fine.

[primetomas]

I'm not comfortable with k8s myself, so can give generic advice. Does the log of the ejbca-node1 container say anything specific? I.e. it could be that it can't reach the database or something so the EJBCA application isn't started.

[quyen66]

I checked everything is running in k8s. This's logs in ejbca-node1 kubectl logs service/ejbca-node1 -n ingress

I1204 03:28:56.573789       7 main.go:209] "Creating API client" host="https://10.152.183.1:443"
-------------------------------------------------------------------------------
NGINX Ingress controller
  Release:       v1.8.0
  Build:         35f5082ee7f211555aaff431d7c4423c17f8ce9e
  Repository:    https://github.com/kubernetes/ingress-nginx
  nginx version: nginx/1.21.6

-------------------------------------------------------------------------------

I1204 03:28:56.591970       7 main.go:253] "Running in Kubernetes cluster" major="1" minor="28" git="v1.28.3" state="clean" commit="a8a1abc25cad87333840cd7d54be2efaf31a3177" platform="linux/amd64"
I1204 03:28:57.317542       7 main.go:104] "SSL fake certificate created" file="/etc/ingress-controller/ssl/default-fake-certificate.pem"
I1204 03:28:57.407387       7 nginx.go:261] "Starting NGINX Ingress controller"
I1204 03:28:57.432640       7 event.go:285] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"ingress", Name:"nginx-ingress-tcp-microk8s-conf", UID:"bedb1844-eae5-4e0f-bc00-d58e86ad9478", APIVersion:"v1", ResourceVersion:"569", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap ingress/nginx-ingress-tcp-microk8s-conf
I1204 03:28:57.432755       7 event.go:285] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"ingress", Name:"nginx-ingress-udp-microk8s-conf", UID:"9f6af1da-9943-405b-8d47-28e998123868", APIVersion:"v1", ResourceVersion:"570", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap ingress/nginx-ingress-udp-microk8s-conf
I1204 03:28:57.433148       7 event.go:285] Event(v1.ObjectReference{Kind:"ConfigMap", Namespace:"ingress", Name:"nginx-load-balancer-microk8s-conf", UID:"8e7d8a58-5366-471e-be1c-4c649ce307c4", APIVersion:"v1", ResourceVersion:"568", FieldPath:""}): type: 'Normal' reason: 'CREATE' ConfigMap ingress/nginx-load-balancer-microk8s-conf
I1204 03:28:58.609536       7 nginx.go:304] "Starting NGINX process"
I1204 03:28:58.609727       7 leaderelection.go:248] attempting to acquire leader lease ingress/ingress-controller-leader...
I1204 03:28:58.610487       7 controller.go:190] "Configuration changes detected, backend reload required"
I1204 03:28:58.639346       7 leaderelection.go:258] successfully acquired lease ingress/ingress-controller-leader
I1204 03:28:58.639901       7 status.go:84] "New leader elected" identity="nginx-ingress-microk8s-controller-g9hf7"
I1204 03:28:58.817753       7 controller.go:207] "Backend successfully reloaded"
I1204 03:28:58.818190       7 controller.go:218] "Initial sync, sleeping for 1 second"
I1204 03:28:58.818356       7 event.go:285] Event(v1.ObjectReference{Kind:"Pod", Namespace:"ingress", Name:"nginx-ingress-microk8s-controller-g9hf7", UID:"e1295356-6d54-4bf2-8094-c1589ce3b6bf", APIVersion:"v1", ResourceVersion:"990", FieldPath:""}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration
I1204 03:35:29.678939       7 store.go:433] "Found valid IngressClass" ingress="ejbca-k8s/ejbca-node1" ingressclass="public"
W1204 03:35:29.679220       7 backend_ssl.go:47] Error obtaining X.509 certificate: no object matching key "ejbca-k8s/tls-secret" in local store
W1204 03:35:29.679357       7 controller.go:1209] Service "ejbca-k8s/ejbca-service" does not have any active Endpoint.
W1204 03:35:29.679399       7 controller.go:1704] Error getting SSL certificate "ejbca-k8s/tls-secret": local SSL certificate ejbca-k8s/tls-secret was not found
I1204 03:35:29.679455       7 controller.go:190] "Configuration changes detected, backend reload required"
I1204 03:35:29.679944       7 event.go:285] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"ejbca-k8s", Name:"ejbca-node1", UID:"d1ebe39c-7f37-4af0-9117-5d5a9411cd33", APIVersion:"networking.k8s.io/v1", ResourceVersion:"1668", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
I1204 03:35:30.031131       7 controller.go:207] "Backend successfully reloaded"
I1204 03:35:30.031523       7 event.go:285] Event(v1.ObjectReference{Kind:"Pod", Namespace:"ingress", Name:"nginx-ingress-microk8s-controller-g9hf7", UID:"e1295356-6d54-4bf2-8094-c1589ce3b6bf", APIVersion:"v1", ResourceVersion:"990", FieldPath:""}): type: 'Normal' reason: 'RELOAD' NGINX reload triggered due to a change in configuration
W1204 03:35:46.128171       7 controller.go:1209] Service "ejbca-k8s/ejbca-service" does not have any active Endpoint.
W1204 03:35:46.128217       7 controller.go:1704] Error getting SSL certificate "ejbca-k8s/tls-secret": local SSL certificate ejbca-k8s/tls-secret was not found
I1204 03:35:58.838698       7 status.go:300] "updating Ingress status" namespace="ejbca-k8s" ingress="ejbca-node1" currentValue=null newValue=[{"ip":"127.0.0.1"}]
W1204 03:35:58.850852       7 backend_ssl.go:47] Error obtaining X.509 certificate: no object matching key "ejbca-k8s/tls-secret" in local store
W1204 03:35:58.851169       7 controller.go:1209] Service "ejbca-k8s/ejbca-service" does not have any active Endpoint.
W1204 03:35:58.851333       7 controller.go:1704] Error getting SSL certificate "ejbca-k8s/tls-secret": local SSL certificate ejbca-k8s/tls-secret was not found
I1204 03:35:58.851456       7 event.go:285] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"ejbca-k8s", Name:"ejbca-node1", UID:"d1ebe39c-7f37-4af0-9117-5d5a9411cd33", APIVersion:"networking.k8s.io/v1", ResourceVersion:"1718", FieldPath:""}): type: 'Normal' reason: 'Sync' Scheduled for sync
W1204 03:39:31.127533       7 controller.go:1209] Service "ejbca-k8s/ejbca-service" does not have any active Endpoint.
W1204 03:39:31.137144       7 controller.go:1704] Error getting SSL certificate "ejbca-k8s/tls-secret": local SSL certificate ejbca-k8s/tls-secret was not found
W1204 03:42:41.727644       7 controller.go:1704] Error getting SSL certificate "ejbca-k8s/tls-secret": local SSL certificate ejbca-k8s/tls-secret was not found ```

Here logs of cmd kubectl logs service/ejbca-service -n ejbca-k8s

[primetomas]

Looks like your ingress fails to get any TLS certificate doesn't it?

[quyen66]

Is that required to access, I check the tutorial but cant see anystep create that tls-secret but they still can access the web?

[telcmege]

Hi, I'm having a similar problem configuring the ingress with the helm deploy method. I've followed the doc over on github but I can't access EJBCA. When I add /ejbca to the host it stops responding

Here are the logs from the ingress-controller

Could it have something to do with AJP support being removed from ingress-nginx?