You are browsing documentation for an outdated version. See the latest documentation here.
Configuring https redirect
This guide walks through how to configure the Kong Ingress Controller to redirect HTTP request to HTTPS so that all communication from the external world to your APIs and microservices is encrypted.
Installation
Please follow the deployment documentation to install the Kong Ingress Controller on your Kubernetes cluster.
Testing Connectivity to Kong
This guide assumes that the PROXY_IP
environment variable is
set to contain the IP address or URL pointing to Kong.
Please follow one of the
deployment guides to configure this environment variable.
If everything is setup correctly, making a request to Kong should return HTTP 404 Not Found.
$ curl -i $PROXY_IP
HTTP/1.1 404 Not Found
Date: Fri, 21 Jun 2019 17:01:07 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Content-Length: 48
Server: kong/1.2.1
{"message":"no Route matched with those values"}
This is expected as Kong does not yet know how to proxy the request.
Setup a Sample Service
For the purpose of this guide, we will setup an httpbin service in the cluster and proxy it.
kubectl apply -f https://raw.githubusercontent.com/Kong/kubernetes-ingress-controller/v2.11.0/deploy/manifests/httpbin.yaml
service/httpbin created
deployment.apps/httpbin created
Create an Ingress rule to proxy the httpbin service we just created:
$ echo '
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: demo
annotations:
konghq.com/strip-path: "true"
spec:
ingressClassName: kong
rules:
- http:
paths:
- path: /foo
pathType: ImplementationSpecific
backend:
service:
name: httpbin
port:
number: 80
' | kubectl apply -f -
ingress.extensions/demo created
Test the Ingress rule:
$ curl -i $PROXY_IP/foo/status/200
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Server: gunicorn/19.9.0
Date: Wed, 17 Jul 2019 19:25:32 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Kong-Upstream-Latency: 2
X-Kong-Proxy-Latency: 1
Via: kong/3.1.1
Setup HTTPS redirect
To instruct Kong to redirect all HTTP requests matching this Ingress rule to HTTPS, update its annotations to limit its protocols to HTTPS only and issue a 308 redirect:
$ kubectl patch ingress demo -p '{"metadata":{"annotations":{"konghq.com/protocols":"https","konghq.com/https-redirect-status-code":"308"}}}'
ingress.extensions/demo patched
Test it
Now, making a plain-text HTTP request to Kong will result in a redirect being issued from Kong:
$ curl $PROXY_IP/foo/headers -I
HTTP/1.1 308 Permanent Redirect
Date: Tue, 06 Aug 2019 18:04:38 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Location: https://35.197.125.63/foo/headers
Server: kong/1.2.1
The Location
header will contain the URL you need to use for an HTTPS
request. Please note that this URL will be different depending on your
installation method. You can also grab the IP address of the load balancer
fronting Kong and send a HTTPS request to test it.
Let’s test it:
$ curl -k https://35.197.125.63/foo/headers
{
"headers": {
"Accept": "*/*",
"Connection": "keep-alive",
"Host": "35.197.125.63",
"User-Agent": "curl/7.54.0",
"X-Forwarded-Host": "35.197.125.63"
}
}
We can see that Kong correctly serves the request only on HTTPS protocol
and redirects the user if plaint-text HTTP protocol is used.
We had to use -k
flag in cURL to skip certificate validation as the
certificate served by Kong is a self-signed one.
If you are serving this traffic via a domain that you control and have
configured TLS properties for it, then the flag won’t
be necessary.
If you have a domain that you control but don’t have TLS/SSL certificates for it, please check out Using cert-manager with Kong guide which can get TLS certificates setup for you automatically. And it’s free, thanks to Let’s Encrypt!