---
id: 367d381e-720a-4591-a138-dfb4b312f74a
---

# Kubernetes - Misconfigured Ingress Resources
---

Misconfigured Ingress Resources is an incident type that occurs when the Ingress resources in a Kubernetes cluster are not properly configured, resulting in routing or security issues. Ingress resources are used to manage external access to services in a cluster, and when not configured correctly, can cause issues such as incorrect routing of traffic or unauthorized access to resources. This can result in service disruptions, security breaches, and other problems that can impact the overall performance and stability of the system.

### Parameters
```shell
export NAMESPACE="PLACEHOLDER"

export LABEL_SELECTOR="PLACEHOLDER"

export INGRESS_NAME="PLACEHOLDER"

export PATH_TO_KUBECONFIG_FILE="PLACEHOLDER"

export INGRESS_CONFIG_FILE="PLACEHOLDER"
```

## Debug

### Check if the ingress controller is running
```shell
kubectl get pods -n ${NAMESPACE} -l ${LABEL_SELECTOR}
```

### Check if the ingress resources are correctly configured
```shell
kubectl describe ingress ${INGRESS_NAME} -n ${NAMESPACE}
```

### Check if the ingress resources have all the required annotations
```shell
kubectl describe ingress ${INGRESS_NAME} -n ${NAMESPACE} | grep -i annotation
```

### Check if the ingress resources have the correct backend service and port
```shell
kubectl describe ingress ${INGRESS_NAME} -n ${NAMESPACE} | grep -i backend
```

### Check if the ingress resources have the correct rules and paths
```shell
kubectl describe ingress ${INGRESS_NAME} -n ${NAMESPACE} | grep -i rule
```

### The Ingress resource was not properly configured with the appropriate routing rules and security policies.
```shell


#!/bin/bash



# Kubernetes cluster details

KUBECONFIG=${PATH_TO_KUBECONFIG_FILE}

NAMESPACE=${NAMESPACE}



# Get the Ingress resources associated with the application

INGRESS_LIST=$(kubectl --kubeconfig=$KUBECONFIG get ingress -n $NAMESPACE -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')



# Loop through each Ingress resource and check for issues

for INGRESS_NAME in $INGRESS_LIST

do

  # Check if the Ingress resource has any routing rules

  RULES=$(kubectl --kubeconfig=$KUBECONFIG get ingress $INGRESS_NAME -n $NAMESPACE -o jsonpath='{.spec.rules}')

  if [ -z "$RULES" ]; then

    echo "Ingress resource $INGRESS_NAME does not have any routing rules"

  fi



  # Check if the Ingress resource has any security policies

  TLS=$(kubectl --kubeconfig=$KUBECONFIG get ingress $INGRESS_NAME -n $NAMESPACE -o jsonpath='{.spec.tls}')

  if [ -z "$TLS" ]; then

    echo "Ingress resource $INGRESS_NAME does not have any security policies"

  fi

done


```

## Repair

### Re-deploy the ingress resources to ensure that they are correctly configured and functional.
```shell


#!/bin/bash



# 1. Set the ${NAMESPACE} and ${INGRESS_NAME} variables to the appropriate values for your cluster

namespace=${NAMESPACE}

ingress_name=${INGRESS_NAME}



# 2. Delete the existing Ingress resources

kubectl delete ingress $ingress_name -n $namespace



# 3. Wait for the resources to be deleted before proceeding

sleep 10



# 4. Re-deploy the Ingress resources using the appropriate configuration file

kubectl apply -f ${INGRESS_CONFIG_FILE} -n $namespace



# 5. Verify that the new Ingress resources are correctly configured and functional

kubectl get ingress $ingress_name -n $namespace


```

Misconfigured Ingress Resources is an incident type that occurs when the Ingress resources in a Kubernetes cluster are not properly configured, resulting in routing or security issues. Ingress resources are used to manage external access to services in a cluster, and when not configured correctly, can cause issues such as incorrect routing of traffic or unauthorized access to resources. This can result in service disruptions, security breaches, and other problems that can impact the overall performance and stability of the system.


This incident type refers to an increase in the number of errors per second on a Tomcat server, which could indicate an issue with the server itself, the host, a deployed application, or an application servlet. This could include errors generated when the Tomcat server runs out of memory, can't find a requested file or servlet, or is unable to serve a JSP due to syntax errors in the servlet codebase. This incident type requires immediate attention to diagnose and address the underlying issue.


Increase of the errors/second rate for Tomcat server

This incident type is characterized by the detection of unauthorized access to the Kubernetes API server. This unauthorized access potentially enables attackers to manipulate cluster resources. Such incidents can lead to serious consequences, as unauthorized access allows attackers to make changes to the Kubernetes cluster, which may compromise the security and integrity of the entire system. Therefore, it is crucial to promptly detect and address such incidents to ensure the security and proper functioning of the Kubernetes cluster.


Unauthorized Access to Kubernetes API Server Detected

This incident type involves an issue with Kubernetes deployments where the expected number of pods to run is not matching the actual number of pods running. This can lead to alerts being triggered and potential disruptions in the system.


Kubernetes pods not starting - Deployment issue

This incident type involves monitoring the replicas of a Kubernetes Statefulset, which is a type of workload in Kubernetes used for stateful applications. The incident is triggered when more than one replica's pods are down, creating an unsafe situation for manual operations. This incident is critical and requires immediate attention to resolve the issue and ensure the smooth functioning of the stateful applications.


Kubernetes Statefulset Replicas Monitoring Incident

A Kubernetes Replicaset Incomplete incident typically occurs when a specific number of pods that should be running are not, due to reasons such as failed pod initialization, unavailability of resources in the cluster, or inability to pull the image. This incident is usually triggered when the difference between desired and running pods is greater than zero, and it can be detected through monitoring tools like Datadog.


Kubernetes Replicaset Incomplete

```shell
export NAMESPACE="PLACEHOLDER"

export LABEL_SELECTOR="PLACEHOLDER"

export INGRESS_NAME="PLACEHOLDER"

export PATH_TO_KUBECONFIG_FILE="PLACEHOLDER"

export INGRESS_CONFIG_FILE="PLACEHOLDER"
```


### Check if the ingress controller is running

```shell
kubectl get pods -n ${NAMESPACE} -l ${LABEL_SELECTOR}
```

### Check if the ingress resources are correctly configured

```shell
kubectl describe ingress ${INGRESS_NAME} -n ${NAMESPACE}
```

### Check if the ingress resources have all the required annotations

```shell
kubectl describe ingress ${INGRESS_NAME} -n ${NAMESPACE} | grep -i annotation
```

### Check if the ingress resources have the correct backend service and port

```shell
kubectl describe ingress ${INGRESS_NAME} -n ${NAMESPACE} | grep -i backend
```

### Check if the ingress resources have the correct rules and paths

```shell
kubectl describe ingress ${INGRESS_NAME} -n ${NAMESPACE} | grep -i rule
```

### The Ingress resource was not properly configured with the appropriate routing rules and security policies.

```shell


#!/bin/bash



# Kubernetes cluster details

KUBECONFIG=${PATH_TO_KUBECONFIG_FILE}

NAMESPACE=${NAMESPACE}



# Get the Ingress resources associated with the application

INGRESS_LIST=$(kubectl --kubeconfig=$KUBECONFIG get ingress -n $NAMESPACE -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')



# Loop through each Ingress resource and check for issues

for INGRESS_NAME in $INGRESS_LIST

do

  # Check if the Ingress resource has any routing rules

  RULES=$(kubectl --kubeconfig=$KUBECONFIG get ingress $INGRESS_NAME -n $NAMESPACE -o jsonpath='{.spec.rules}')

  if [ -z "$RULES" ]; then

    echo "Ingress resource $INGRESS_NAME does not have any routing rules"

  fi



  # Check if the Ingress resource has any security policies

  TLS=$(kubectl --kubeconfig=$KUBECONFIG get ingress $INGRESS_NAME -n $NAMESPACE -o jsonpath='{.spec.tls}')

  if [ -z "$TLS" ]; then

    echo "Ingress resource $INGRESS_NAME does not have any security policies"

  fi

done


```


### Re-deploy the ingress resources to ensure that they are correctly configured and functional.

```shell


#!/bin/bash



# 1. Set the ${NAMESPACE} and ${INGRESS_NAME} variables to the appropriate values for your cluster

namespace=${NAMESPACE}

ingress_name=${INGRESS_NAME}



# 2. Delete the existing Ingress resources

kubectl delete ingress $ingress_name -n $namespace



# 3. Wait for the resources to be deleted before proceeding

sleep 10



# 4. Re-deploy the Ingress resources using the appropriate configuration file

kubectl apply -f ${INGRESS_CONFIG_FILE} -n $namespace



# 5. Verify that the new Ingress resources are correctly configured and functional

kubectl get ingress $ingress_name -n $namespace


```


Kubernetes - Misconfigured Ingress Resources

Overview

Parameters

Debug

Check if the ingress controller is running

Check if the ingress resources are correctly configured

Check if the ingress resources have all the required annotations

Check if the ingress resources have the correct backend service and port

Check if the ingress resources have the correct rules and paths

The Ingress resource was not properly configured with the appropriate routing rules and security policies.

Repair

Re-deploy the ingress resources to ensure that they are correctly configured and functional.

Learn more

Related Runbooks

Increase of the errors/second rate for Tomcat server

Unauthorized Access to Kubernetes API Server Detected

Kubernetes pods not starting - Deployment issue

Kubernetes Statefulset Replicas Monitoring Incident

Support