Problem with SSL passthrough in Nginx Controller

Question

I'm forced to use Nginx Ingress, but it's complicated and doesn't fulfill our requirements.

I tried to route traffic from Nginx ingress to Traefik, but it seems that redirection from HTTP to HTTPS doesn't work.

Here is how my Ingress looks like:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
  name: some-ingress
spec:
  tls:
  - hosts:
    - "example.com"
    secretName: some-secret
  rules:
  - host: "example.com"
    http:
      paths:
      - backend:
          serviceName: traefik
          servicePort: 443

I don't know how to fix that. I tried different ways. Maybe there is another way to route HTTP traffic on port 80 to traefik service on port 80 and 443 to traefik service on port 443 (?)

Unfortunately, I'm not able to use any external load balancer because it's not provided. I'm aware that there is something called MetalLB, but I'm not able to fulfill all requirements.

Thank you in advance!

When you say the redirection from HTTP to HTTPS doesn't work, what behavior are you seeing, it staying on HTTP? The docs say "By default the controller redirects (308) to HTTPS if TLS is enabled for that ingress." is the host and secret specified in tls correct? Any logs on the nginx controller pod? — Dom
Yes, it's staying on HTTP and I got timeout. I cannot find anything in logs. — Cayman_h
I read in documentation: This feature is implemented by intercepting all traffic on the configured HTTPS port (default: 443) and handing it over to a local TCP proxy. This bypasses NGINX completely and introduces a non-negligible performance penalty. but it doesn't work even without SSL passthrough... If I have visited site on HTTPS protocol, redirect works well but I think it's handled by web browser. — Cayman_h
There is related issue on github: github.com/kubernetes/ingress-nginx/issues/6722 and simmilar problem on SO: stackoverflow.com/questions/65523064/… — Matt

Eden Dupont Eden Dupont · Accepted Answer · 2021-01-05T20:47:40

Did you try to add the backend-protocol annotation?

nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"

Problem with SSL passthrough in Nginx Controller

1 Answers