We have an GKE ingress that is using the below frontend-service. The ingress terminates tls as well. We want to have http to https permanent redirects for any traffic that comes on http.

With the below configuration we have all working, and serving traffic on both http and https (without redirect).

The container used for the Deployment can be configured to rewrite http to https with --https-redirect flag. It also respect and trust the X-Forwarded-Proto header, and will consider it to be secure if the header value is set to https.

So the most reasonable configuration I can see for the readinessProbe would be the configuration below, but with the commented lines uncommented. However, as soon as we apply this version we never get into a healthy state, and instead the terminated domain configured with the Ingress returns with 502 and never recovers.

So what is wrong with the below approach? I have tested using port-forwarding both the pod and the service, and they both return 301 if I do not provide the X-Forwarded-Proto header, and return 200 if I provide the X-Forwarded-Proto header with https value.

apiVersion: v1
kind: Service
metadata:
  name: frontend-service
spec:
  type: NodePort
  ports:
    - port: 8080
  selector:
    app: frontend
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
spec:
  selector:
    matchLabels:
      app: frontend
  template:
    metadata:
      labels:
        app: frontend
    spec:
      containers:
      - image: eu.gcr.io/someproject/frontend:master
        imagePullPolicy: Always
        # args:
        # - '--https-redirect'
        name: frontend
        resources:
          limits:
            memory: 1Gi
            cpu: '0.5'
        ports:
        - containerPort: 8080
          name: frontend
        readinessProbe:
          httpGet:
            path: /_readinessProbe
            port: 8080
            # httpHeaders:
            # - name: X-Forwarded-Proto
            #   value: https