Kong ingress controller not using custom certificate with LinkerD

[kasabalu]

I'm working with the combination of Linkerd, Kong Ingress Controller, and k3s (single node). I have noticed that every time we reboot the system, the Kong Ingress Controller fails to use the custom certificate for the ingress host, leading to an issue associated with the default certificate instead. The issue is only resolved when we manually restart the Kong Ingress Controller pod, and it seems to occur when using the Linkerd mesh proxy. This issue happens every time we reboot the system
i am using SNI property as well to pass the HOST name . This issue is happening after every reboot. I would appreciate any insights or solutions anyone may have regarding this issue. Thank you!"

`[root@test ~]# curl -ivk https://test.domain.com/rl

• Trying 172.16.0.1...
• TCP_NODELAY set
• Connected to test.domain.com (172.16.0.1) port 443 (#0)
• ALPN, offering h2
• ALPN, offering http/1.1
• successfully set certificate verify locations:
• CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• TLSv1.3 (IN), TLS handshake, Server hello (2):
• TLSv1.3 (IN), TLS handshake, [no content] (0):
• TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
• TLSv1.3 (IN), TLS handshake, [no content] (0):
• TLSv1.3 (IN), TLS handshake, Certificate (11):
• TLSv1.3 (IN), TLS handshake, [no content] (0):
• TLSv1.3 (IN), TLS handshake, CERT verify (15):
• TLSv1.3 (IN), TLS handshake, [no content] (0):
• TLSv1.3 (IN), TLS handshake, Finished (20):
• TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
• TLSv1.3 (OUT), TLS handshake, [no content] (0):
• TLSv1.3 (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
• ALPN, server accepted to use h2
• Server certificate:
• subject: C=US; ST=California; L=San Francisco; O=Kong; OU=IT Department; CN=localhost
• start date: Aug 5 18:11:00 2024 GMT
• expire date: Jul 31 18:11:00 2044 GMT
• issuer: C=US; ST=California; L=San Francisco; O=Kong; OU=IT Department; CN=localhost
• SSL certificate verify result: self signed certificate (18), continuing anyway.
• Using HTTP2, server supports multi-use
• Connection state changed (HTTP/2 confirmed)
• Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
• TLSv1.3 (OUT), TLS app data, [no content] (0):
• TLSv1.3 (OUT), TLS app data, [no content] (0):
• TLSv1.3 (OUT), TLS app data, [no content] (0):
• Using Stream ID: 1 (easy handle 0x55e3a2702b00)
• TLSv1.3 (OUT), TLS app data, [no content] (0):

GET /rl HTTP/2
Host: test.domain.com
User-Agent: curl/7.61.1
Accept: /

• TLSv1.3 (IN), TLS handshake, [no content] (0):
• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
• TLSv1.3 (IN), TLS handshake, [no content] (0):
• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
• TLSv1.3 (IN), TLS app data, [no content] (0):
• Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
• TLSv1.3 (OUT), TLS app data, [no content] (0):
  < HTTP/2 404
  HTTP/2 404
  < date: Mon, 05 Aug 2024 19:57:46 GMT
  date: Mon, 05 Aug 2024 19:57:46 GMT
  < content-type: application/json; charset=utf-8
  content-type: application/json; charset=utf-8
  < content-length: 52
  content-length: 52
  < x-kong-response-latency: 0
  x-kong-response-latency: 0
  < server: kong/3.3.1
  server: kong/3.3.1

<

• TLSv1.3 (IN), TLS app data, [no content] (0):
  {
  "message":"no Route matched with those values"}

[ProBrian]

Hi @tao12345666333 , could you help to have a look at this Kong Ingress controller issue?

[kasabalu]

@tao12345666333 @ProBrian can you please help here. I would appreciate any insights or solution