Control planes unreachable due to expired SSL certificate on ingress-public ConfigMap

Last updated: October 28, 2026

Control planes unreachable due to expired SSL certificate on ingress-public ConfigMap

Issue

Unable to access control planes. Listing control planes fails with a TLS certificate error similar to:

listing control planes: Unable to connect to the server: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2026-10-27T13:43:08Z is after 2026-10-08T16:54:41Z

Environment

Spaces (Self-Hosted) · Spaces v1.17.3 · UXP · EKS

Applies to any Space that was originally installed on a Spaces version earlier than 1.15 and has since been upgraded.

Resolution

First, check whether your Space is affected by running the following two commands against the Space cluster:

kubectl -n upbound-system get cm ingress-public -o jsonpath='{.data.ingress-ca}' | openssl x509 -noout -enddate
kubectl -n upbound-system get cm ingress-public -o jsonpath='{.metadata.managedFields[*].manager}'

If the first command shows an expired date, and the second command lists mxe-controller-init as a field manager, this Space is affected. Apply the fix below.

Steps to fix (repeat for each affected Space):

  1. Back up the existing ConfigMap:

    kubectl -n upbound-system get cm ingress-public -o yaml > ingress-public.bak.yaml

  2. (Destructive) Delete the ConfigMap:

    kubectl -n upbound-system delete cm ingress-public

  3. Restart the Spaces controller, which will recreate the ConfigMap with the correct CA and without the stale field manager:

    kubectl -n upbound-system rollout restart deploy/spaces-controller

After the rollout completes, verify that the CA expiry date is now valid by re-running the first check command above. Repeat this process for each Space that shows mxe-controller-init as a field manager.

Cause

Spaces versions prior to 1.15 wrote the ingress-public ConfigMap using server-side apply, setting mxe-controller-init as the field manager. Newer Spaces versions no longer use this field manager, but the stale ownership entry remains in the ConfigMap metadata after an upgrade. This stale owner prevents the current controller from updating the CA certificate when it rotates, causing the ConfigMap to retain an expired CA and making control planes unreachable via TLS.

To confirm this is your cause: the second check command above will return mxe-controller-init as one of the field managers on the ingress-public ConfigMap.