Skip to content

Gateway-API HTTP-01: HTTPRoute rejected when hostname is an IP address #8442

@alviss7

Description

@alviss7

Describe the bug:
When using the ACME HTTP-01 solver with Gateway API and requesting a certificate for an IP address, cert-manager sets HTTPRoute.spec.hostnames[0] to that IP. For IPv6 this is immediately rejected by the API server, for example:

The HTTPRoute "httproute-test" is invalid: spec.hostnames[0]: Invalid value: "2001:db8::1": spec.hostnames[0] in body should match ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

Even if IPv4 (e.g. 192.0.2.1) can sometimes appear to work, the Gateway API spec explicitly says that hostname does not support IP literals: https://gateway-api.sigs.k8s.io/reference/spec/#hostname

The hostname field on HTTPRoute is optional, so for IP challenges it should be left unset.

Expected behaviour:
For HTTP-01 challenges where the target is an IP address (IPv4 or IPv6), cert-manager should not set HTTPRoute.spec.hostnames at all. The solver should still be able to complete HTTP-01 validation using a hostname-less HTTPRoute. For normal DNS names, the current behaviour (setting spec.hostnames to the DNS name) should remain unchanged.

Steps to reproduce the bug:

  1. Install cert-manager with Gateway HTTP-01 enabled.
  2. Create a Certificate that targets an IP address, for example:
    apiVersion: cert-manager.io/v1
    kind: Certificate
    metadata:
      name: ip-cert
    spec:
      ipAddresses:
        - 2001:db8::1
      issuerRef:
        name: letsencrypt-http01
        kind: ClusterIssuer
        group: cert-manager.io
      secretName: ip-cert

Metadata

Metadata

Assignees

Labels

area/acme/http01Indicates a PR modifies ACME HTTP01 provider codekind/featureCategorizes issue or PR as related to a new feature.priority/backlogHigher priority than priority/awaiting-more-evidence.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions