26

I have a backend using https. I want to separate load on that back-end based on URL/path.

I decided to use ingress to do this url/path based logic in order to move traffic to different back-ends ( same back-ends , just duplicated to different NodePorts )

my question is how I can configure the ingress to receive https requests and to forward those https requests to the https back-end?

thanks

edit: I added the yaml file:

spec:
  rules:
  - http:
      paths:
      - backend:
          serviceName: service
          servicePort: 9443
        path: /carbon
      - backend:
          serviceName: service2
          servicePort: 9443
        path: /oauth

for some reason I can;t change the rule form http to https

eran meiri
  • 1,322
  • 3
  • 12
  • 29

2 Answers2

59

Attention: This answer applies to the ingress-nginx solution provided by the kubernetes organisation on github (https://github.com/kubernetes/ingress-nginx)

If you want to use load balancing mechanisms in k8s you should use services instead and start multiple instances behind that service that way k8s will do the load balancing. If you want to use different versions of your backend (e.g. prod and test) your way of separating them is fine

if your service is only reachable via https you need to add the following annotation to your ingress yaml: (documentation)

nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"

To secure ingress itself take a look at this: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls

But if you want that the backend services decrypt the TLS communication use the following annotation instead: (documentation)

nginx.ingress.kubernetes.io/ssl-passthrough: "true"

Edit:

The Ingress YAML should look like this if you want to reach the backend via TLS:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-name
  namespace: namespace-name 
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  rules:
  - http:
      paths:
      - backend:
          serviceName: service
          servicePort: 9443
        path: /carbon
      - backend:
          serviceName: service2
          servicePort: 9443
        path: /oauth

The Ingress YAML should look like this if you want to reach the backend via TLS with TLS decryption in the ingress controller:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-name
  namespace: namespace-name 
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  tls:
  - hosts:
    - app.myorg.com
    secretName: tls-secret 
  rules:
  - http:
      paths:
      - backend:
          serviceName: service
          servicePort: 9443
        path: /carbon
      - backend:
          serviceName: service2
          servicePort: 9443
        path: /oauth

It's important to note that tls-secret is the name of a SecretConfig with a valid Certificate issued for the host (app.myorg.com)

The Ingress YAML should look like this if you want to reach the backend via TLS with TLS decryption in the backend:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-name
  namespace: namespace-name 
  annotations:
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
spec:
  rules:
  - http:
      paths:
      - backend:
          serviceName: service
          servicePort: 9443
        path: /carbon
      - backend:
          serviceName: service2
          servicePort: 9443
        path: /oauth

I never tested the last version myself so i don't know if that actually works but I'd strongly advise reading this passage for that variant.

BeWu
  • 1,941
  • 1
  • 16
  • 22
  • please see my edits , for some reason I can't change the rule to https – eran meiri Jan 31 '19 at 12:51
  • That behaviour is right because you need to change the used protocol with an annotation. See the updated answer for reference. – BeWu Jan 31 '19 at 13:49
  • This answer helped me solve a cross-namespace routing configuration. Ally my deployments expose services over https and adding `nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"` in the ingress manifest in each namespace solved my problem. – Brett K. Jun 05 '21 at 18:47
  • Wow, thank you for this explanation! – mimoralea Mar 16 '22 at 18:28
  • Strangely this annotation is NOT required when you use traefik as an ingress controller. It seems to pick up on `spec.tls` being present. – Marc Mar 25 '22 at 18:25
  • @Marc Yes, different ingress controllers tend to implement their own set of annotations and have their own quirks, that is one of the reasons that the gateway api (https://gateway-api.sigs.k8s.io/) is being developed. Right now it doesn't really make a difference if you use custom resources of the chosen ingress controller or the ingress resource of k8s because of the multitude of annotations k8s ingresses aren't likely to work with a different ingress controller anyways. – BeWu Mar 25 '22 at 19:39
3

If you are using the NGINX Ingress controller (https://docs.nginx.com/nginx-ingress-controller/), the nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" does not work. However, the nginx.org/ssl-services will let you pick the services that require TLS on the backend. The name is confusing, so it took me a while to realize the real purpose of it.

This does not work with the standard Kubernetes Ingress controller that uses NGINX under the hood; it only works with the NGINX-sourced controller.

Advanced annotation docs: https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/

In this example, NGINX will connect to the ssl-svc using TLS; it ignores any self-signed certificates. Example (https://github.com/nginxinc/kubernetes-ingress/tree/v1.12.0/examples/ssl-services):

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    nginx.org/ssl-services: "ssl-svc"
spec:
  rules:
  - host: cafe.example.com
    http:
      paths:
      - path: /tea
        backend:
          serviceName: tea-svc
          servicePort: 80
      - path: /coffee
        backend:
          serviceName: coffee-svc
          servicePort: 80
      - path: /ssl
        backend:
          serviceName: ssl-svc
          servicePort: 443
Doug
  • 3,472
  • 3
  • 21
  • 18