Hi,
I just noticed something which is more of a curiosity than anything.
On an ‘ingress’ in DigitalOcean Kubernetes, if the “tls” section is filled out, and a cert-manager annotation is present, there appears to be an automatic http->https redirect happening in the browser.
At this stage, I have not installed cert-manager, nor installed actual TLS certificates. The cert says “Kubernetes Ingress Controller Fake Certificate”.
The point is that I have not set any specific annotations requesting http->https redirects.
That fact that it occurs is surprising.
When I remove all reference to tls and certs, the redirect disappears.
Where is this behavior coming from? Where is it documented and explained?
Perhaps we can imagine that it makes sense to assume you’d want such a redirect, whenever you install TLS certs. Otherwise why are you installing certs.
Thanks.
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Accepted Answer
Hi Sam,
according to the Ingress Nginx docs: https://kubernetes.github.io/ingress-nginx/user-guide/tls/#server-side-https-enforcement-through-redirect
By default the controller redirects HTTP clients to the HTTPS port 443 using a 308 Permanent Redirect response if TLS is enabled for that Ingress.
This can be disabled globally using
ssl-redirect: "false"in the NGINX config map, or per-Ingress with thenginx.ingress.kubernetes.io/ssl-redirect: "false"annotation in the particular resource.
If TLS is defined, most people want to use HTTPS exclusively and this redirection seems to be the default behavior as soon as you enable TLS. Use the above annotation to disable it if you don’t want/need it.
Daniel, Founder of Deckrun
Hey!
I believe this behavior comes from the default NGINX Ingress Controller that DOKS uses. When you add a tls: section to your Ingress, it kind of assumes you want HTTPS and starts redirecting HTTP to HTTPS automatically, even if the cert is just the default “Fake Certificate.”
I don’t think this is triggered by cert-manager itself, but more like built into how the ingress controller handles TLS. You can probably disable it by adding this annotation:
nginx.ingress.kubernetes.io/ssl-redirect: "false"
I don’t think that it is documented in the DOKS docs, but I guess it makes sense that it’d behave this way when TLS is present.
- Bobby
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.