You are browsing documentation for an older version. See the latest documentation here.

Configuring HTTPS redirect

Overview

Learn to configure the Kong Ingress Controller to redirect HTTP requests to HTTPS so that all communication from the external world to your APIs and microservices is encrypted.

Deploy an echo service

To proxy requests, you need an upstream application to send a request to. Deploying this echo server provides a simple application that returns information about the Pod it’s running in:

kubectl apply -f https://docs.konghq.com/assets/kubernetes-ingress-controller/examples/echo-service.yaml

The results should look like this:

service/echo created
deployment.apps/echo created

Create a configuration group

Ingress and Gateway APIs controllers need a configuration that indicates which set of routing configuration they should recognize. This allows multiple controllers to coexist in the same cluster. Before creating individual routes, you need to create a class configuration to associate routes with:

echo "
---

apiVersion: gateway.networking.k8s.io/v1beta1
kind: GatewayClass
metadata:
  name: kong
  annotations:
    konghq.com/gatewayclass-unmanaged: 'true'
spec:
  controllerName: konghq.com/kic-gateway-controller
---

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: kong
spec:
  gatewayClassName: kong
  listeners:
  - name: proxy
    port: 80
    protocol: HTTP
" | kubectl apply -f -

gatewayclass.gateway.networking.k8s.io/kong created
gateway.gateway.networking.k8s.io/kong created

echo "
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: kong
spec:
  controller: ingress-controllers.konghq.com/kong
" | kubectl apply -f -

ingressclass.networking.k8s.io/kong configured

kubectl get gateway kong

NAME   CLASS   ADDRESS        READY   AGE
kong   kong    203.0.113.42   True    4m46s

Kong Ingress Controller recognizes the kong IngressClass and konghq.com/kic-gateway-controller GatewayClass by default. Setting the CONTROLLER_INGRESS_CLASS or CONTROLLER_GATEWAY_API_CONTROLLER_NAME environment variable to another value overrides these defaults.

Add routing configuration

Create routing configuration to proxy /echo requests to the echo server:

echo "
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: echo
  annotations:
    konghq.com/strip-path: 'true'
spec:
  parentRefs:
  - name: kong
  hostnames:
  - 'kong.example'
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /echo
    backendRefs:
    - name: echo
      kind: Service
      port: 1027
" | kubectl apply -f -

echo "
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: echo
  annotations:
    konghq.com/strip-path: 'true'
spec:
  ingressClassName: kong
  rules:
  - host: kong.example
    http:
      paths:
      - path: /echo
        pathType: ImplementationSpecific
        backend:
          service:
            name: echo
            port:
              number: 1027
" | kubectl apply -f -

The results should look like this:

httproute.gateway.networking.k8s.io/echo created

ingress.networking.k8s.io/echo created

Test the routing rule:

curl -i -H 'Host:kong.example' $PROXY_IP/echo

The results should look like this:

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Content-Length: 140
Connection: keep-alive
Date: Fri, 21 Apr 2023 12:24:55 GMT
X-Kong-Upstream-Latency: 0
X-Kong-Proxy-Latency: 1
Via: kong/3.2.2

Welcome, you are connected to node docker-desktop.
Running on Pod echo-7f87468b8c-tzzv6.
In namespace default.
With IP address 10.1.0.237.
...

If everything is deployed correctly, you should see the above response. This verifies that Kong Gateway can correctly route traffic to an application running inside Kubernetes.

Add TLS configuration

The routing configuration can include a certificate to present when clients connect over HTTPS. This is not required, as Kong Gateway will serve a default certificate if it cannot find another, but including TLS configuration along with routing configuration is typical.

1. Create a test certificate for the kong.example hostname.

   OpenSSL 1.1.1

   OpenSSL 0.9.8

   openssl req -subj '/CN=kong.example' -new -newkey rsa:2048 -sha256 \
     -days 365 -nodes -x509 -keyout server.key -out server.crt \
     -addext "subjectAltName = DNS:kong.example" \
     -addext "keyUsage = digitalSignature" \
     -addext "extendedKeyUsage = serverAuth" 2> /dev/null;
     openssl x509 -in server.crt -subject -noout

   openssl req -subj '/CN=kong.example' -new -newkey rsa:2048 -sha256 \
     -days 365 -nodes -x509 -keyout server.key -out server.crt \
     -extensions EXT -config <( \
      printf "[dn]\nCN=kong.example\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:kong.example\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth") 2>/dev/null;
     openssl x509 -in server.crt -subject -noout

   The results should look like this:

   OpenSSL 1.1.1

   OpenSSL 0.9.8

   subject=CN = kong.example

   subject=CN = kong.example

   Older OpenSSL versions, including the version provided with OS X Monterey, require using the alternative version of this command.

2. Create a Secret containing the certificate.

    kubectl create secret tls kong.example --cert=./server.crt --key=./server.key
   

   The results should look like this:

    secret/kong.example created
   

3. Update your routing configuration to use this certificate.

   Ingress

   Gateway API

   kubectl patch --type json ingress echo -p='[{
       "op":"add",
   	"path":"/spec/tls",
   	"value":[{
           "hosts":["kong.example"],
   		"secretName":"kong.example"
       }]
   }]'

   kubectl patch --type=json gateway kong -p='[{
       "op":"add",
       "path":"/spec/listeners/-",
       "value":{
           "name":"proxy-ssl",
           "port":443,
           "protocol":"HTTPS",
           "tls":{
               "certificateRefs":[{
                   "group":"",
                   "kind":"Secret",
                   "name":"kong.example"
               }]
           }
       }
   }]'
   

   The results should look like this:

   Ingress

   Gateway API

   ingress.networking.k8s.io/echo patched

   gateway.gateway.networking.k8s.io/kong patched

4. Send requests to verify if the configured certificate is served.

    curl -ksv https://kong.example/echo --resolve kong.example:443:$PROXY_IP 2>&1 | grep -A1 "certificate:"
   

   The results should look like this:

    * Server certificate:
    *  subject: CN=kong.example
   

Configure an HTTPS redirect

Kong handles HTTPS redirects by automatically issuing redirects to requests whose characteristics match an HTTPS-only route except for the protocol. For example, with a Kong route such as this:

{ "protocols": ["https"], "hosts": ["kong.example"],
  "https_redirect_status_code": 301, "paths": ["/echo/"], "name": "example" }

A request for http://kong.example/echo/green receives a 301 response with a Location: https://kong.example/echo/green header. Kubernetes resource annotations instruct the controller to create a route with protocols=[https] and https_redirect_status_code set to the code of your choice (the default if unset is 426).

1. Configure the protocols that are allowed in the konghq.com/protocols annotation.

   Ingress

   Gateway API

   kubectl annotate ingress echo konghq.com/protocols=https

   kubectl annotate httproute echo konghq.com/protocols=https

   The results should look like this:

   Ingress

   Gateway API

   ingress.networking.k8s.io/echo annotated

   httproute.gateway.networking.k8s.io/echo annotated

2. Configure the status code used to redirect in the konghq.com/https-redirect-status-code` annotation.

   Ingress

   Gateway API

   kubectl annotate ingress echo konghq.com/https-redirect-status-code="301"

   kubectl annotate httproute echo konghq.com/https-redirect-status-code="301"

   The results should look like this:

   Ingress

   Gateway API

   ingress.networking.k8s.io/echo annotated

   httproute.gateway.networking.k8s.io/echo annotated

Note: The GatewayAPI does not use a HTTPRequestRedirectFilter to configure the redirect. Using the filter to redirect HTTP to HTTPS requires a separate HTTPRoute to handle redirected HTTPS traffic, which does not align well with Kong’s single route redirect model.

Work to support the standard filter-based configuration is ongoing. Until then, the annotations allow you to configure HTTPS-only HTTPRoutes.

Test the configuration

With the redirect configuration in place, HTTP requests now receive a redirect rather than being proxied upstream:

1. Send a HTTP request.

    curl -ksvo /dev/null -H 'Host: kong.example' http://$PROXY_IP/echo 2>&1 | grep -i http
   

   The results should look like this:

    > GET /echo HTTP/1.1
    < HTTP/1.1 301 Moved Permanently
    < Location: https://kong.example/echo
   

2. Send a curl request to follow redirects using the -L flag navigates to the HTTPS URL and receive a proxied response from upstream.

    curl -Lksv -H 'Host: kong.example' http://$PROXY_IP/echo 2>&1
   

   The results should look like this (some output removed for brevity):

    > GET /echo HTTP/1.1
    > Host: kong.example
    >
    < HTTP/1.1 301 Moved Permanently
    < Location: https://kong.example/echo
    < Server: kong/3.4.2
       
    * Issue another request to this URL: 'https://kong.example/echo'
   
    * Server certificate:
    *  subject: CN=kong.example
        
    > GET /echo HTTP/2
    > Host: kong.example
    >
    < HTTP/2 200
    < via: kong/3.4.2
    <
    Welcome, you are connected to node kind-control-plane.
    Running on Pod echo-74d47cc5d9-pq2mw.
    In namespace default.
    With IP address 10.244.0.7.
   

Kong correctly serves the request only on HTTPS protocol and redirects the user if the HTTP protocol is used. The -k flag in cURL skips certificate validation as the certificate served by Kong is a self-signed one. If you are serving this traffic through a domain that you control and have configured TLS properties for it, then the flag won’t be necessary.

If you have a domain that you control but don’t have TLS/SSL certificates for it, see Using cert-manager with Kong guide which can get TLS certificates setup for you automatically. And it’s free, thanks to Let’s Encrypt!