Change:
Is this a BUG REPORT or FEATURE REQUEST?: /kind bug What happened: Defined the nginx ingress controller service like so: What you expected to happen: A new ELB with TLS certificate on port 443, no TLS certificate on port 80, and access logs sent to S3 bucket "my-bucket". The load balancer is created, TLS certificate is attached as expected, no access logging is configured. Furthermore, changing the annotations and re-applying the spec has non-deterministic results. I removed the annotations regarding the logging setup, and the TLS certificate was eventually removed from my load balancer. I had to destroy it and re-create it for it to exist again. I am also unable to confirm whether or not the annotations are actually created. Listing the service with either or shows only one annotation, . How to reproduce it (as minimally and precisely as possible): Create a service with the above annotations, observe that no logging is set up. Anything else we need to know?: Environment: Kubernetes version (use ):Cloud provider or hardware configuration: AWS OS (e.g. from /etc/os-release): OSX Kernel (e.g. ): 16.7.0 Install tools: kops
Reiterating the mentions to trigger a notification: <detailsIn response to : </details
/sig cloud-provider
Encountered the same problem. In my case, the annotation is the one that makes the ELB as internal: 0.0.0.0/0
I have also been encountering the issue as above. It is only when I spin up an ingress-nginx elb service. If I add the annotation to any of my over services it works as expected
This should help solve the issue, nice workaround, keep the issue closed
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
Stale issues rot after 30d of inactivity. Mark the issue as fresh with . Rotten issues close after an additional 30d of inactivity. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle rotten
Not sure if it's related or not, but two of the annotations needed to be quoted ("true", and "5") /remove-sig api-machinery
I experienced this issue as well. The annotations were not present in the resulting Service, and the desired effects (adding Tags to the ELB, setting specific Security Groups) were not achieved. After adding quotes to these two annotations, it started working: Ideally, Kubernetes would give some kind of an indication that the annotations were ignored/removed. Otherwise, this could be a security issue due to creation of an ELB with a public IP with a Security Group that allows ingress from any IP. Lacking that, it requires manual verification of the resulting ELB.
closing as a duplicate of /close
Closing this issue. <detailsIn response to : closing as a duplicate of Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details

Discussion:
"helper.go", "interfaces.go", "mapper.go", <ins> "metadata_decoder.go", </ins> "result.go", "scheme.go", "selector.go",

"//staging/src/k8s.io/apimachinery/pkg/runtime:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/runtime/serializer:go_default_library", <ins> "//staging/src/k8s.io/apimachinery/pkg/runtime/serializer/json:go_default_library", </ins> "//staging/src/k8s.io/apimachinery/pkg/types:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/util/errors:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/util/sets:go_default_library",

localFn:      b.isLocal, restMapperFn: b.restMapperFn, clientFn:     b.getClient, <del> decoder:      unstructured.UnstructuredJSONScheme, </del> <ins> decoder:      &metadataValidatingDecoder{unstructured.UnstructuredJSONScheme}, </ins> } return b

} } ` <ins> var aPodBadAnnotations string = ` { "kind": "Pod", "apiVersion": "` + corev1GV.String() + `", "metadata": { "name": "busybox{id}", "labels": { "name": "busybox{id}" }, "annotations": { "name": 0 } }, "spec": { "containers": [ { "name": "busybox", "image": "busybox", "command": [ "sleep", "3600" ], "imagePullPolicy": "IfNotPresent" } ], "restartPolicy": "Always" } } ` </ins> var aRC string = ` {

WithScheme(scheme.Scheme, scheme.Scheme.PrioritizedVersionsAllGroups()...) } <ins> func newUnstructuredDefaultBuilder() *Builder { return newUnstructuredDefaultBuilderWith(fakeClient()) } func newUnstructuredDefaultBuilderWith(fakeClientFn FakeClientFunc) *Builder { return NewFakeBuilder( fakeClientFn, func() (meta.RESTMapper, error) { return testrestmapper.TestOnlyStaticRESTMapper(scheme.Scheme), nil }, func() (restmapper.CategoryExpander, error) { return FakeCategoryExpander, nil }). Unstructured() } </ins> type errorRestMapper struct { meta.RESTMapper err error

}) } } <ins> func TestUnstructured(t *testing.T) { // create test dirs tmpDir, err := utiltesting.MkTmpdir("unstructured_test") if err != nil { t.Fatalf("error creating temp dir: %v", err) } defer os.RemoveAll(tmpDir) // create test files writeTestFile(t, fmt.Sprintf("%s/pod.json", tmpDir), aPod) writeTestFile(t, fmt.Sprintf("%s/badpod.json", tmpDir), aPodBadAnnotations) tests := []struct { name          string file          string expectedError string }{ { name:          "pod", file:          "pod.json", expectedError: "", }, { name:          "badpod", file:          "badpod.json", expectedError: "v1.ObjectMeta.Annotations", }, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { result := newUnstructuredDefaultBuilder(). ContinueOnError(). FilenameParam(false, &FilenameOptions{Recursive: false, Filenames: []string{fmt.Sprintf("%s/%s", tmpDir, tc.file)}}). Flatten(). Do() err := result.Err() if err == nil { _, err = result.Infos() } if len(tc.expectedError) == 0 { if err != nil { t.Errorf("unexpected error: %v", err) } } else { if err == nil { t.Errorf("expected error, got none") } else if !strings.Contains(err.Error(), tc.expectedError) { t.Errorf("expected error with '%s', got: %v", tc.expectedError, err) } } }) } } </ins>

<ins> /* Copyright 2019 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ package resource import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apimachinery/pkg/runtime/serializer/json" ) // hold a single instance of the case-sensitive decoder var caseSensitiveJsonIterator = json.CaseSensitiveJsonIterator() // metadataValidatingDecoder wraps a decoder and additionally ensures metadata schema fields decode before returning an unstructured object type metadataValidatingDecoder struct { decoder runtime.Decoder } func (m *metadataValidatingDecoder) Decode(data []byte, defaults *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) { obj, gvk, err := m.decoder.Decode(data, defaults, into) // if we already errored, return if err != nil { return obj, gvk, err } // if we're not unstructured, return if _, isUnstructured := obj.(runtime.Unstructured); !isUnstructured { return obj, gvk, err } // make sure the data can decode into ObjectMeta before we return, // so we don't silently truncate schema errors in metadata later with accesser get/set calls v := &metadataOnlyObject{} if typedErr := caseSensitiveJsonIterator.Unmarshal(data, v); typedErr != nil { return obj, gvk, typedErr } return obj, gvk, err } type metadataOnlyObject struct { metav1.TypeMeta   `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` } </ins>