K
Q

Ability to exclude one page from https redirection in nginx ingress controller

2/17/2020

I have an app in Kubernetes which is served over https. So now I would like to exclude one URL from that rule and use HTTP to serve it for performance reasons. I am struggling with that the whole day and it seems impossible.

These are my ingress YAML:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    field.cattle.io/publicEndpoints: '[{"addresses":["172.31.1.11"],"port":443,"protocol":"HTTPS","serviceName":"myservice:myservice","ingressName":"myservice:myservice","hostname":"app.server.test.mycompany.com","path":"/","allNodes":true}]'
    kubernetes.io/ingress.class: nginx
  creationTimestamp: "2020-02-17T13:14:19Z"
  generation: 1
  labels:
    app-kubernetes-io/instance: mycompany
    app-kubernetes-io/managed-by: Tiller
    app-kubernetes-io/name: mycompany
    helm.sh/chart: mycompany-1.0.0
    io.cattle.field/appId: mycompany
  name: mycompany
  namespace: mycompany
  resourceVersion: "565608"
  selfLink: /apis/extensions/v1beta1/namespaces/mycompany/ingresses/mycompany
  uid: c6b93108-a28f-4de6-a62b-487708b3f5d1
spec:
  rules:
  - host: app.server.test.mycompany.com
    http:
      paths:
      - backend:
          serviceName: mycompany
          servicePort: 80
        path: /
  tls:
  - hosts:
    - app.server.test.mycompany.com
    secretName: mycompany-tls-secret
status:
  loadBalancer:
    ingress:
    - ip: 172.31.1.11
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    field.cattle.io/publicEndpoints: '[{"addresses":["172.31.1.1"],"port":80,"protocol":"HTTP","serviceName":"mycompany:mycompany","ingressName":"mycompany:mycompany-particular-service","hostname":"app.server.test.mycompany.com","path":"/account_name/particular_service/","allNodes":true}]'
    nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
    nginx.ingress.kubernetes.io/use-regex: "true"
  creationTimestamp: "2020-02-17T13:14:19Z"
  generation: 1
  labels:
    app-kubernetes-io/instance: mycompany
    app-kubernetes-io/managed-by: Tiller
    app-kubernetes-io/name: mycompany
    helm.sh/chart: mycompany-1.0.0
    io.cattle.field/appId: mycompany
  name: mycompany-particular-service
  namespace: mycompany
  resourceVersion: "565609"
  selfLink: /apis/extensions/v1beta1/namespaces/mycompany/ingresses/mycompany-particular-service
  uid: 88127a02-e0d1-4b2f-b226-5e8d160c1654
spec:
  rules:
  - host: app.server.test.mycompany.com
    http:
      paths:
      - backend:
          serviceName: mycompany
          servicePort: 80
        path: /account_name/particular_service/
status:
  loadBalancer:
    ingress:
    - ip: 172.31.1.11

So as you can see from above I would like to server /particular_service/ over HTTP. Ingress, however, redirects to HTTPS as TLS is enabled for that host in the first ingress.

Is there any way to disable TLS just for that one specific path when the same host is being used for configuration?

In short summary I would like to have:

https://app.server.test.mycompany.com
but
http://app.server.test.mycompany.com/account_name/particular_service/
-- szaman
kubernetes
kubernetes-ingress
nginx
nginx-ingress

Similar Questions

Highly available ActiveMQ inside Kubernetes
How to use --wait with post-install hook in helm?
Is it possible to use Cloud NAT with public GKE Cluster?
PKIX path building failed on Kubernetes AutoDevOps

2 Answers

2/17/2020

Also add nginx.ingress.kubernetes.io/ssl-redirect ": "false". It had worked for me previously. You can give it a try.

-- anmol agrawal
Source: StackOverflow
2/17/2020

I've tested with 2 ingress of the same domain, the first one with tls enabled and the second without tls and it worked.

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  name: echo-https
spec:
  tls:
  - hosts:
    - myapp.mydomain.com
    secretName: https-myapp.mydomain.com
  rules:
  - host: myapp.mydomain.com
    http:
      paths:
      - backend:
          serviceName: echo-svc
          servicePort: 80
        path: /
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
  name: echo-http
spec:
  rules:
  - host: myapp.mydomain.com
    http:
      paths:
      - backend:
          serviceName: echo-svc
          servicePort: 80
        path: /insecure

By the Nginx docs:

By default the controller redirects HTTP clients to the HTTPS port 443 using a 308 Permanent Redirect response if TLS is enabled for that Ingress.

This can be disabled globally using ssl-redirect: "false" in the NGINX config map, or per-Ingress with the nginx.ingress.kubernetes.io/ssl-redirect: "false" annotation in the particular resource.

Please let me if that helps.

-- KoopaKiller
Source: StackOverflow