K
Q

https for eks loadbalancer

6/29/2019

I want to secure my web application running on Kubernetes (EKS). I have one front-end service .Front end service is running on port 80 .I want to run this on port 443 .When I kubectl get all .I see that my load balancer is running on port 443 , but I am not able to open it in the browser.

---
apiVersion: v1
kind: Service
metadata:
  name: hello-kubernetes
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:us-west-2:1234567890:certificate/12345c409-ec32-41a8-8542-712345678
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
spec:
  type: LoadBalancer
  ports:
  - port: 443
    targetPort: 80
    protocol: TCP
  selector:
    app: hello-kubernetes
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-kubernetes
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello-kubernetes
  template:
    metadata:
      labels:
        app: hello-kubernetes
    spec:
      containers:
      - name: hello-kubernetes
        image: 123456789.dkr.ecr.us-west-2.amazonaws.com/demoui:demo123
        ports:
        - containerPort: 80
        env:
        - name: MESSAGE
          value: Hello Kubernetes!
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: hello-ingress
  annotations:
    kubernetes.io/ingress.class: "alb"
    alb.ingress.kubernetes.io/healthcheck-path: "/"
    alb.ingress.kubernetes.io/success-codes: "200,404"
    alb.ingress.kubernetes.io/scheme: "internet-facing"
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80} , {"HTTPS": 443}]'
spec:
  rules:
  - http:
      paths:
      - path: /
        backend:
          serviceName: hello-kubernetes
          servicePort: 80
-- user17970
amazon-eks
kubectl
kubernetes-ingress
yaml

Similar Questions

Filebeat on Kubernetes modules are not working
Rails app deploying with unicorn and Nginx can't load static resources on Kubernetes infraestructure
Thanos on Bare Metal
expose internal dns kubernetes
How to enable or check Intel "VT-d" in a GCP VM
EKS cluster created by kops does not appear in AWS console
Deployment failing because memory insufficient

3 Answers

1/2/2020
alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'

https://kubernetes-sigs.github.io/aws-alb-ingress-controller/guide/tasks/ssl_redirect/

-- Stella
Source: StackOverflow
7/8/2019

Here is what I have for my cluster to run on https.

In my ingress/Load balancer:

service.beta.kubernetes.io/aws-load-balancer-ssl-cert: CERT
service.beta.kubernetes.io/aws-load-balancer-ssl-ports: https
    # ports using the ssl certificate
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
    # which protocol a Pod speaks

In my Ingress controller, configMap of the nginx configuration:

    app.kubernetes.io/force-ssl-redirect: "true"

Hope this works for you.

-- shrimpy
Source: StackOverflow
7/16/2019

AWS ALB Ingress Controller is designed to create application Load Balancer and relevant resources on AWS level within Ingress YAML configuration file. Actually, ALB Ingress controller parses configuration for the load balancer from the Ingress YAML definition file and then apply Target groups one per Kubernetes service with specified instances and NodePorts exposed on a particular nodes. On the top level Listeners expose connection port for Load Balancer and make decision for request routing according to defined routing rules as per official AWS ALB Ingress Controller Workflow documentation.

Just after a short theory tour, I have a few concerns about you current configuration:

  1. First, I would recommend to check AWS ALB Ingress Controller
    setup and inspect the relevant logs:

kubectl logs -n kube-system $(kubectl get po -n kube-system | egrep -o "alb-ingress[a-zA-Z0-9-]+")

And then verify whether Load Balancer has been successfully generated within AWS console.

  1. Inspect Target groups for particular ALB in order to ensure whether health checks for k8s instances all are good.

  2. Ensure, whether Security groups contain appropriate firewall rules for your instances in order to allow inbound and outbound network traffic across ALB.

I encourage you to get familiar with dedicated chapter about HTTP to HTTPS redirection in the official AWS ALB Ingress Controller documentation.

-- mk_sta
Source: StackOverflow