Trouble setting up secure connection for ingress behind ingress - bad gateway

Question

I'm trying to set up a connection to a kubernetes cluster and I'm getting a 502 bad gateway error.

The cluster has an nginx ingress and a service (listening at both http and https). In addition the ingress is behind an nginx ingress service (I have nginx helm chart installed) with a static IP address.

I can see in the description of the cluster ingress that it knows the service's endpoints. I see that the pods communicate successfully with each other (there are 3 pods), but I can't ping the external nginx from within a shell.

These are the cluster's ingress values in values.yaml:

  ingress:
    # If `true`, an Ingress is created
    enabled: true
    # The Service port targeted by the Ingress
    servicePort: http
    # Ingress annotations
    annotations:
      kubernetes.io/ingress.class: "nginx"
    # Additional Ingress labels
    labels: {}
      # List of rules for the Ingress
    rules:
      -
        # Ingress host
        host: my-app.com
        # Paths for the host
        paths:
          - /
    # TLS configuration
    tls:
      - hosts:
          - my-app.com
        secretName: my-app-tls

When I go to my-app.com I see in the browser that I'm on a secure connection (the lock icon next to the URL), but like I said I get a 502 bad gateway error. If I replace the servicePort from http to https I get the '400 bad request' error.

How should I set up both ingresses to allow a secured connection to my app? I tried all sorts of annotations, but always got the errors above.

        nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
        nginx.ingress.kubernetes.io/ssl-redirect: "false"

Thank you!

Rohit Rohit · Accepted Answer · 2020-08-08T12:23:03

The ingress definition that you have shared doesn't ingress definition and its values file.

Ingress definition should look something like below

{{- if .Values.ingress.enabled -}}
{{- $fullName := include "app.fullname" . -}}
{{- $svcPort := .Values.service.port -}}
apiVersion: networking.k8s.io/v1beta1
{{- else -}}
apiVersion: extensions/v1beta1
{{- end }}
kind: Ingress
metadata:
  name: {{ $fullName }}
  labels:
    {{- include "app.labels" . | nindent 4 }}
  {{- with .Values.ingress.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
{{- if .Values.ingress.tls }}
  tls:
  {{- range .Values.ingress.tls }}
    - hosts:
      {{- range .hosts }}
        - {{ . | quote }}
      {{- end }}
      secretName: {{ .secretName }}
  {{- end }}
{{- end }}
  rules:
  {{- range .Values.ingress.hosts }}
    - host: {{ .host | quote }}
      http:
        paths:
        {{- range .paths }}
          - path: /
            backend:
              serviceName: {{ $fullName }}
              servicePort: {{ $svcPort }}
        {{- end }}
  {{- end }}
{{- end }}

This gets executed if your values has ingress enabled=true.

  service:
    type: ClusterIP
    port: 8080

  ingress:
    enabled: true

Trouble setting up secure connection for ingress behind ingress - bad gateway

2 Answers