# Container setup, kubernetes ingress bypass

**URL:** <https://community.icinga.com/t/container-setup-kubernetes-ingress-bypass/9283>\
**Category:** Icinga 2\
**Tags:** master, container, kubernetes\
**Created:** [February 22, 2022, 9:32am UTC](https://community.icinga.com/t/container-setup-kubernetes-ingress-bypass/9283 "2022-02-22T09:32:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![verboese](https://community.icinga.com/user_avatar/community.icinga.com/verboese/32/994_2.png) [@verboese](https://community.icinga.com/u/verboese)\
**Post date:** [February 22, 2022, 9:32am UTC](https://community.icinga.com/t/container-setup-kubernetes-ingress-bypass/9283/1 "2022-02-22T09:32:19Z")

</div>

I’m currently struggling with our new setup of Icinga in (Azure-)Kubernetes. I got it installed and configured with modules (director, …) and everything, but I fail to add agents due to PKI errors. This is the error on agent’s side:

```auto
information/pki: Writing certificate to file '/var/lib/icinga2/certs/trusted-master.crt'.
critical/cli: Could not fetch valid response. Please check the master log.
ERROR: Could not retrieve final certificate from host icinga-api.my.fqdn.cxm

```

The master shows nothing at all in it’s log. I assume this is a problem with the (NGinX-)Ingress in between, which of course is not able to sign certificate requests.

I already tried to configure the ingress to pass auth-tls to the upstream. I’m out of ideas ¯\_(ツ)_/¯  
Anyone here who could point out another possible solution to this?

---

<div class="post-metadata">

**Author:** ![Al2Klimov](https://community.icinga.com/user_avatar/community.icinga.com/al2klimov/32/959_2.png) [@Al2Klimov](https://community.icinga.com/u/Al2Klimov)\
**Post date:** [February 23, 2022, 12:37pm UTC](https://community.icinga.com/t/container-setup-kubernetes-ingress-bypass/9283/2 "2022-02-23T12:37:20Z")

</div>

Hello @verboese!

Well, you have to forward the SSL traffic as-is.