K
Q

Use https protocol for endpoints in Kubernetes Services

12/10/2020

Tried creating a Kubernetes endpoints service to invoke resource hosted outside the cluster via static IP's over HTTPS protocol. Below is the endpoint code 

kind: Service
apiVersion: v1
metadata:
  name: serviceRequest
spec:
  ports:
    - port: 8081
      targetPort: 8094      
      
---
kind: Endpoints
apiVersion: v1
metadata:
  name: serviceRequest
subsets:
  - addresses:
      - ip: XX.XX.XX.XX // **external IP which is accessible as https://XX.XX.XX.XX:8094**
    ports:
      - port: 8094

But the above configuration is giving 400 Bad Request with message as "This combination of host and port requires TLS."

Same is working for http not for https exposed "ip".Could someone please guide how to achieve this.

##Update1 This is how the flow is configured. Ingress->service->endpoints

-- pri
azure-aks
kubectl
kubernetes
kubernetes-pod
kubernetes-service

Similar Questions

Kubernetes CronJob run once in the future
On Google can Kubernetes nodes be configured to have multiple network interfaces?
Kubernetes - Network policy for communication b/w services
Google Kubernetes private cluster: Google Compute Engine: Exceeded maximum supported number of secondary ranges per subnetwork
how install grafana with helm and with a path "/grafana" instead of path "/"

3 Answers

12/12/2020

Kubernetes Service is no more than a set of forwarding rules in iptables (most often), and it knows nothing about TLS.
If you want to enforce https redirection you might use ingress controller for this. All major ingress controllers have this capability.

For example, check for nginx-ingress.
https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-side-https-enforcement-through-redirect.

Basically, all you need is to add this annotation to your ingress rule.
nginx.ingress.kubernetes.io/ssl-redirect: "true"

-- Olesya Bolobova
Source: StackOverflow
2/18/2021

Easypeasy, just add port 443 to the Service that will make the request TLS/https:

kind: Service
apiVersion: v1
metadata:
  name: serviceRequest
spec:
  ports:
    - port: 443 # <-- this is the way
      targetPort: 8094      
      
---
kind: Endpoints
apiVersion: v1
metadata:
  name: serviceRequest
subsets:
  - addresses:
      - ip: XX.XX.XX.XX # **external IP which is accessible as https://XX.XX.XX.XX:8094**
    ports:
      - port: 8094

So you can reach your serviceRequest from your containers on https://serviceRequest url.

Also keep in mind that in yaml the # character is the comment sing not //

-- zsolt
Source: StackOverflow
12/10/2020

This is the error message your get when calling a https endpoint with http. Are you sure that whoever is calling your service, is calling it with https:// at the beginning?

-- Fritz Duchardt
Source: StackOverflow