Nginx Ingress resource annotation to setup proxy_pass directive

3/17/2021

When I use nginx as ingress controller for my k8s cluster, specifying an ingress rule automatically creates corresponding configurations in the /etc/nginx/conf.d/ files of nginx pod.

So, it configures proxy_pass directive there to relevant upstream/backend service. And it is http. For this ingress rule for my service:

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  # annotations:
  #  nginx.org/redirect-to-https: "false"
  #  #nginx.ingress.kubernetes.io/ssl-passthrough: "true"
spec:
  ingressClassName: nginx 
  tls:
  - hosts:
    - test.myapp.com
    secretName: test-tls-secret
  rules:
  - host: test.myapp.com
    http:
      paths:
      - backend:
          serviceName: myui
          servicePort: 80
      - path: /api/
        backend:
          serviceName: myapp
          servicePort: 88              

By default, it automatically creates this directive for backend in nginx configuration:

 proxy_pass http://default-my-ingress-test.myapp.com-myapp-88;

But instead, i need it to be https like this:

proxy_pass https://default-my-ingress-test.myapp.com-myapp-88;

Then only my application will work as that backend accepts https requests only.

Is there any way to modify that proxy_pass directive for a particular backend service for this purpose, using any annotations or something like that via Ingress resource?


EDIT:

Is there any annotation like that available?

Or Is there any option that I could handle it with a sidecar container in the same pod with the actual myapp container?

-- AnjanaAK
kubernetes
kubernetes-ingress
nginx
nginx-ingress
proxy

1 Answer

3/17/2021

I had a similar requirement very recently where the backend pods expected the request on https.

What you'd need is ssl-passthrough feature of nginx controller. You need to start the nginx ingress controller with flag --enable-ssl-passthrough. This can be passed as a command line argument to the nginx deployment.

Thereafter, the ingress resource needs to be deployed with the following annotations:

kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
nginx.ingress.kubernetes.io/secure-backends: "true"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"

to instruct the controller to send TLS connections directly to the backend.

-- rock'n rolla
Source: StackOverflow