Ingress await semantics are too strict

Hi

After upgrading to version 3.10.1 We are getting this error on creation of a ingress object

the Kubernetes API server reported that “ingress-system/gateway-default-8i88hdw3” failed to fully initialize or become live: ‘gateway-default-8i88hdw3’ timed out waiting to be Ready Ingress has at least one rule that does not target any Service. Field ‘.spec.rules[].http.paths[].backend.service.name’ may not match any active Service

We are using a default Ingress object without any http rules other then host. This has allowed us to share TLS setting with other Ingress objects. This is suppoted by the nginx controller we use.

var defaultIngress = new Pulumi.Kubernetes.Networking.V1.Ingress(
	GetLogicalName("default"), new IngressArgs
	{
		Metadata = new ObjectMetaArgs
		{
			Namespace = _namespace.Metadata.Apply(c => c.Name),
			Annotations =
			{
				{ "nginx.ingress.kubernetes.io/ssl-redirect", "false" }
			}
		},
		Spec = new IngressSpecArgs
		{
			IngressClassName = "nginx",
			Tls ={
				new IngressTLSArgs
				{
					Hosts = PublicIpFqdn,
					SecretName = _certificate.Apply(c=> c.KubernetesSecretName)!
				}
			},
			Rules = new IngressRuleArgs
			{
				Host = PublicIpFqdn
			}
		}

	}, new()
	{
		Parent = this,
		DependsOn = _chart.GetChildren()
	});

Issue details

Steps to reproduce

1. Provision a ingress object without any http rules

Expected: The update to have no breaking changes Actual: Did have a breaking change

[sziegler-skyhook]

I am also running into this problem using the AWS ALB Controller + K8S Ingresses.

The ALB controller uses annotations to forward traffic to a specific target group and therefore the backend service name is not an actual K8S service. (see here: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/guide/ingress/annotations/#traffic-routing)

Here is my use case:

kind: Ingress
metadata:
  name: ingress-a
  namespace: default
  annotations:
    alb.ingress.kubernetes.io/actions.forward-to-9443: '{"type":"forward","targetGroupARN":"{{ .Values.aws.primary.TargetGroup }}"}'
  spec:
  rules:
  - http:
      paths:
        - pathType: Prefix
          path: /a
          backend:
            service:
              name: forward-to-9443
              port:
                name: use-annotation
        - pathType: Prefix
          path: /b
          backend:
            service:
              name: forward-to-9443
              port:
                name: use-annotation
        - pathType: Exact
          path: /c
          backend:
            service:
              name: forward-to-9443
              port:
                name: use-annotation

This results in error: Ingress has at least one rule that does not target any Service. Field '.spec.rules[].http.paths[].backend.service.name' may not match any active Service because the service forward-to-9443 does not exist, it is an AWS ALB Annotation.

[viveklak]

I renamed the issue to use this as a tracking issue to consider relaxing the constraints currently imposed for ingress await logic. The suggested workaround for the moment is to use the pulumi.com/skipAwait: "true" annotation on the affected ingress objects. However, attempts to extract loadbalancer addresses etc. will have to resort to refreshing or polling the ingress object in such cases.