Redirect Traffic from HTTP to HTTPS¶
We'll use the alb.ingress.kubernetes.io/actions.${action-name}
annotation to setup an ingress to redirect http traffic into https
Example Ingress Manifest¶
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
namespace: default
name: ingress
annotations:
kubernetes.io/ingress.class: alb
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-west-2:xxxx:certificate/xxxxxx
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
spec:
rules:
- http:
paths:
- path: /*
backend:
serviceName: ssl-redirect
servicePort: use-annotation
- path: /users/*
backend:
serviceName: user-service
servicePort: 80
- path: /*
backend:
serviceName: default-service
servicePort: 80
Note
alb.ingress.kubernetes.io/listen-ports
annotation must at least include [{"HTTP": 80}, {"HTTPS":443}] to listen on 80 and 443.alb.ingress.kubernetes.io/certificate-arn
annotation must be set to allow listen for HTTPS traffic- the
ssl-redirect
action must be be first rule(which will be evaluated first by ALB)
How it works¶
By default, all rules specified in ingress spec will be applied to all listeners(one listener per port) on ALB.
If there is an redirection rule, the ALB ingress controller will check it against every listener(port) to see whether it will introduce infinite redirection loop, and will ignore that rule for specific listener.
So for our above example, the rule by ssl-redirect
will only been applied to http(80) listener.