Question
DigitalOcean Kubernetes Ingress redirect http->https
- Posted on April 18, 2025
- Kubernetes
Asked by Sam Darwin
Hi,
I just noticed something which is more of a curiosity than anything.
On an ‘ingress’ in DigitalOcean Kubernetes, if the “tls” section is filled out, and a cert-manager annotation is present, there appears to be an automatic http->https redirect happening in the browser.
At this stage, I have not installed cert-manager, nor installed actual TLS certificates. The cert says “Kubernetes Ingress Controller Fake Certificate”.
The point is that I have not set any specific annotations requesting http->https redirects.
That fact that it occurs is surprising.
When I remove all reference to tls and certs, the redirect disappears.
Where is this behavior coming from? Where is it documented and explained?
Perhaps we can imagine that it makes sense to assume you’d want such a redirect, whenever you install TLS certs. Otherwise why are you installing certs.
Thanks.
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.
Hi Sam,
according to the Ingress Nginx docs: https://kubernetes.github.io/ingress-nginx/user-guide/tls/#server-side-https-enforcement-through-redirect
If TLS is defined, most people want to use HTTPS exclusively and this redirection seems to be the default behavior as soon as you enable TLS. Use the above annotation to disable it if you don’t want/need it.
Daniel, Founder of Deckrun
Hey!
I believe this behavior comes from the default NGINX Ingress Controller that DOKS uses. When you add a
tls:section to your Ingress, it kind of assumes you want HTTPS and starts redirecting HTTP to HTTPS automatically, even if the cert is just the default “Fake Certificate.”I don’t think this is triggered by cert-manager itself, but more like built into how the ingress controller handles TLS. You can probably disable it by adding this annotation:
I don’t think that it is documented in the DOKS docs, but I guess it makes sense that it’d behave this way when TLS is present.
- Bobby