ingress-nginx: nginx: HTTP->HTTPS redirect does not work

https://github.com/kubernetes/ingress/tree/master/controllers/nginx#server-side-https-enforcement says that the HTTP->HTTPS redirect should be enabled by default if a TLS config is given for the Ingress.

For some reason that does not work for me. I am out of ideas why this might be the case. Any suggestions?

About this issue

Original URL
State: closed
Created 7 years ago
Reactions: 3
Comments: 28 (9 by maintainers)

Most upvoted comments

If you’re wondering why this broke again after 0.9.0-beta.18, then you’ll need to update your annotations to nginx.ingress.kubernetes.io/force-ssl-redirect: "true".

Also note that the redirect changed from a 301 to a 308 permanent redirect!

macropin on Dec 11, 2017

ingress.kubernetes.io/force-ssl-redirect: "true" works for me.

tuannvm on Aug 21, 2017

@aledbf That image worked!

Thanks

wstrange on Apr 18, 2017

@wstrange please use the image quay.io/aledbf/nginx-ingress-controller:0.89

aledbf@me:~/go/src/k8s.io/ingress$ kubectl exec -it -n kube-system nginx-ingress-controller-3199894280-z42tq -- curl -v -H "Host: openig.default.example.com" localhost:80
* Rebuilt URL to: localhost:80/
*   Trying ::1...
* Connected to localhost (::1) port 80 (#0)
> GET / HTTP/1.1
> Host: openig.default.example.com
> User-Agent: curl/7.47.0
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Server: nginx/1.11.12
< Date: Sun, 16 Apr 2017 18:31:24 GMT
< Content-Type: text/html
< Content-Length: 186
< Connection: keep-alive
< Location: https://openig.default.example.com/
< Strict-Transport-Security: max-age=15724800; includeSubDomains; 
< 
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.11.12</center>
</body>
</html>
* Connection #0 to host localhost left intact
aledbf@me:~/go/src/k8s.io/ingress$ !2032
kubectl exec -it -n kube-system nginx-ingress-controller-3199894280-z42tq -- curl -v -H "Host: openig.default.example.com" https://localhost:443 -k
* Rebuilt URL to: https://localhost:443/
*   Trying ::1...
* Connected to localhost (::1) port 443 (#0)
* found 173 certificates in /etc/ssl/certs/ca-certificates.crt
* found 692 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
* 	 server certificate verification SKIPPED
* 	 server certificate status verification SKIPPED
* 	 common name: Kubernetes Ingress Controller Fake Certificate (does not match 'localhost')
* 	 server certificate expiration date OK
* 	 server certificate activation date OK
* 	 certificate public key: RSA
* 	 certificate version: #3
* 	 subject: O=Acme Co,CN=Kubernetes Ingress Controller Fake Certificate
* 	 start date: Sun, 16 Apr 2017 18:19:35 GMT
* 	 expire date: Mon, 16 Apr 2018 18:19:35 GMT
* 	 issuer: O=Acme Co,CN=Kubernetes Ingress Controller Fake Certificate
* 	 compression: NULL
* ALPN, server accepted to use http/1.1
> GET / HTTP/1.1
> Host: openig.default.example.com
> User-Agent: curl/7.47.0
> Accept: */*
> 
< HTTP/1.1 200 OK
< Server: nginx/1.11.12
< Date: Sun, 16 Apr 2017 18:31:29 GMT
< Content-Type: text/plain
< Transfer-Encoding: chunked
< Connection: keep-alive
< Strict-Transport-Security: max-age=15724800; includeSubDomains; 
< 
CLIENT VALUES:
client_address=172.17.0.6
command=GET
real path=/
query=nil
request_version=1.1
request_uri=http://openig.default.example.com:8080/

SERVER VALUES:
server_version=nginx: 1.10.0 - lua: 10001

HEADERS RECEIVED:
accept=*/*
connection=close
host=openig.default.example.com
user-agent=curl/7.47.0
x-forwarded-for=::1
x-forwarded-host=openig.default.example.com
x-forwarded-port=443
x-forwarded-proto=https
x-original-uri=/
x-real-ip=::1
x-scheme=https
BODY:
* Connection #0 to host localhost left intact
-no body in request-

changing the annotation to false ingress.kubernetes.io/ssl-redirect: "false"

aledbf@me:~/go/src/k8s.io/ingress$ kubectl exec -it -n kube-system nginx-ingress-controller-3199894280-z42tq -- curl -v -H "Host: openig.default.example.com" localhost:80
* Rebuilt URL to: localhost:80/
*   Trying ::1...
* Connected to localhost (::1) port 80 (#0)
> GET / HTTP/1.1
> Host: openig.default.example.com
> User-Agent: curl/7.47.0
> Accept: */*
> 
< HTTP/1.1 200 OK
< Server: nginx/1.11.12
< Date: Sun, 16 Apr 2017 18:33:11 GMT
< Content-Type: text/plain
< Transfer-Encoding: chunked
< Connection: keep-alive
< Strict-Transport-Security: max-age=15724800; includeSubDomains; 
< 
CLIENT VALUES:
client_address=172.17.0.6
command=GET
real path=/
query=nil
request_version=1.1
request_uri=http://openig.default.example.com:8080/

SERVER VALUES:
server_version=nginx: 1.10.0 - lua: 10001

HEADERS RECEIVED:
accept=*/*
connection=close
host=openig.default.example.com
user-agent=curl/7.47.0
x-forwarded-for=::1
x-forwarded-host=openig.default.example.com
x-forwarded-port=80
x-forwarded-proto=http
x-original-uri=/
x-real-ip=::1
x-scheme=http
BODY:
* Connection #0 to host localhost left intact
-no body in request-a

aledbf on Apr 16, 2017

@DanHoerst waiting bprashanth to publish https://github.com/kubernetes/ingress/pull/303

aledbf on Feb 19, 2017

ingress.kubernetes.io/force-ssl-redirect: "true" works for me too.

cluster version: 1.7.4
nginx ingress controller: 0.9.0-beta.15 installed via helm chart

1ambda on Oct 31, 2017

I assume the fix will be included in the next 0.9 release (beta4?).

yes

aledbf on Apr 18, 2017

@aledbf I’m OK with closing

wstrange on Apr 18, 2017

Here is an example:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: openig-ingress
  annotations:
     ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
  - hosts:
    - openig.default.example.com
    secretName: tls-secret
  rules:
  - host: openig.default.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: openig-openig
          servicePort: 80

This is on minikube, using gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.3

wstrange on Apr 15, 2017