enable-ssl-chain-completion=false not respected

[magowant]

Is this a BUG REPORT or FEATURE REQUEST? (choose one): BUG REPORT

NGINX Ingress controller version: 0.10.1

Kubernetes version (use kubectl version): 1.8.3

Environment:

• Cloud provider or hardware configuration: VSphere
• OS (e.g. from /etc/os-release): RHEL 7.4
• Kernel (e.g. uname -a):3.10.0-693.2.2.el7.x86_64
• Install tools:
• Others:
  nginx-ingress-controller argument: --enable-ssl-chain-completion=false

What happened:
Upgrading from 0.8.3 to 0.10.1 failed to generate certs for all of our ingress rules, with the following error:

E0125 07:17:42.342892 5 backend_ssl.go:146] unexpected error generating SSL certificate with full intermediate chain CA certs: Get ldap:///***redacted Active Directory DN*** : unsupported protocol scheme "ldap"

Our x509 certs do not include the full cert chain (which I know is not correct, but 0.8.3 handled this gracefully). The certs do contain the following AIA

Authority Information Access [1]:
    Access Method: CA Issuers (1.3.6.1.5.5.7.48.2)
    Access Location:
        URI: ldap:///***redacted Active Directory DN*** 

It seems that the nginx-ingress-controller is attempting to download the cert from the ldap URL despite --enable-ssl-chain-completion=false.

What you expected to happen:
No attempt should be made to automatically complete the certificate chain, just use the certificate as supplied in the ingress secret.

How to reproduce it (as minimally and precisely as possible):
I can supply a test certificate / key pair on request.

Anything else we need to know:

[aledbf]

@magowant please use quay.io/aledbf/nginx-ingress-controller:0.321

[swade1987]

@magowant looks like from what @aledbf is saying the fix is #1978 but was not released in 0.10.1.

[swade1987]

@magowant i'd go back to using 0.9.0 until this fix is merged into a newer 0.10 release.

[magowant]

I've tested quay.io/aledbf/nginx-ingress-controller:0.321 and it fixed the issue - thanks

[swade1987]

@magowant are you going to stick with this quay.io/aledbf/nginx-ingress-controller:0.321 or wait for the official release?