-
Notifications
You must be signed in to change notification settings - Fork 2.4k
Gateway-API HTTP-01: HTTPRoute rejected when hostname is an IP address #8442
Description
Describe the bug:
When using the ACME HTTP-01 solver with Gateway API and requesting a certificate for an IP address, cert-manager sets HTTPRoute.spec.hostnames[0] to that IP. For IPv6 this is immediately rejected by the API server, for example:
The HTTPRoute "httproute-test" is invalid: spec.hostnames[0]: Invalid value: "2001:db8::1": spec.hostnames[0] in body should match
^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
Even if IPv4 (e.g. 192.0.2.1) can sometimes appear to work, the Gateway API spec explicitly says that hostname does not support IP literals: https://gateway-api.sigs.k8s.io/reference/spec/#hostname
The hostname field on HTTPRoute is optional, so for IP challenges it should be left unset.
Expected behaviour:
For HTTP-01 challenges where the target is an IP address (IPv4 or IPv6), cert-manager should not set HTTPRoute.spec.hostnames at all. The solver should still be able to complete HTTP-01 validation using a hostname-less HTTPRoute. For normal DNS names, the current behaviour (setting spec.hostnames to the DNS name) should remain unchanged.
Steps to reproduce the bug:
- Install cert-manager with Gateway HTTP-01 enabled.
- Create a
Certificatethat targets an IP address, for example:apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: ip-cert spec: ipAddresses: - 2001:db8::1 issuerRef: name: letsencrypt-http01 kind: ClusterIssuer group: cert-manager.io secretName: ip-cert