My company has policies for domain names for certificate creation. How can I customize the "Address" generated by Flyte core? Should that go in the ingress configuration?

cc @Haytham Abuelfutuh @Ketan (kumare3)

Yeah digging into my logs, I also have an issue with the SSL cert; I must be missing some config maybe somewhere...

hey @Katrina P you can add a logger.yaml block to your config map like so:

logger.yaml: |
    logger:
      show-source: true
      level: 6  # Debug

Thanks!

@Shahwar Saleem, so this address you referenced (e.g.

<http://k8s-flyte-8699360f2e-1590325550.us-east-2.elb.amazonaws.com|k8s-flyte-8699360f2e-1590325550.us-east-2.elb.amazonaws.com>

) is generated by the ingress controller (which ingress controller are you using)? If you want to use your own SSL certs, you need to fill in this host field

<https://github.com/flyteorg/flyte/blob/master/charts/flyte-core/values.yaml#L343>

and setup SSL issuance to properly do that (if you use cert-manager operator, it should happen automatically)…

I am using a cert manager but I can try filling that host field with domain name requirements...

host is what you manually enter which. Address is what the ingress controller generates… If you delete and recreate the ingress, you will get a different address everytime but the host can remain the same (since it’s a user managed property)…

I guessed the same. So I filled out the host field. I am trying

flytectl create project --name flyte-project --id flyte-project --description "example flyte-project description" --labels app=flyte

And getting :

Error: rpc error: code = Unavailable desc = name resolver error: produced zero addresses

My hosts in

kubectl -n ssaleem-flyte get ingress

command are:

<http://flytedev.x.y.z.io|flytedev.x.y.z.io>

Have you configured the host to point to that load balancer in DNS records?

Hmm, I am not sure how to do that. Does this have to be configured in my config files?

nope, this is purely a domain config… who owns the flytedev.x.y.z.io domain? This is an optional step, you totally don’t have to use your own domain hence why these steps are not in the guide…

My company owns this, and certificates are issued only to those domain names. There is a format of domain names that we have to follow.

np… so you will need to have someone who controls DNS records to be able to add a CNAME record for that domain

I see and after doing that the certificate would be validated for

<http://flytedev.x.y.z.io|flytedev.x.y.z.io>

?

Depending on how you generated the cert, if you have used cert-manager or have manually issued a cert, you will have to update the TLS section: https://github.com/flyteorg/flyte/blob/master/charts/flyte-core/values.yaml#L343-L347 (specifically the

secretName

)

My problem for the flytectl was solved by changing this line:

separateGrpcIngressAnnotations:
      <http://alb.ingress.kubernetes.io/backend-protocol-version|alb.ingress.kubernetes.io/backend-protocol-version>: HTTP2

To:

separateGrpcIngressAnnotations:
      <http://alb.ingress.kubernetes.io/backend-protocol-version|alb.ingress.kubernetes.io/backend-protocol-version>: GRPC

These annotations do nothing and can be removed:

<http://nginx.ingress.kubernetes.io/app-root|nginx.ingress.kubernetes.io/app-root>: /console
    <http://nginx.ingress.kubernetes.io/backend-protocol|nginx.ingress.kubernetes.io/backend-protocol>: GRPC

Oh, thank you @Shahwar Saleem! Do you mind upstreaming that change? Regarding:

``` nginx.ingress.kubernetes.io/app-root: /console

nginx.ingress.kubernetes.io/backend-protocol: GRPC```

These are only respected when you deploy nginx… we tried to set the default annotations to work with either so they require less after-deployment changes. CC @Yee @Yuvraj @Brian Connolly

Hi @Haytham Abuelfutuh, I will do that, shortly.

@Shahwar Saleem thank you