Report this

What is the reason for this report?

DigitalOcean Kubernetes Ingress redirect http->https

Posted on April 18, 2025

Hi,

I just noticed something which is more of a curiosity than anything.

On an ‘ingress’ in DigitalOcean Kubernetes, if the “tls” section is filled out, and a cert-manager annotation is present, there appears to be an automatic http->https redirect happening in the browser.

At this stage, I have not installed cert-manager, nor installed actual TLS certificates. The cert says “Kubernetes Ingress Controller Fake Certificate”.

The point is that I have not set any specific annotations requesting http->https redirects.

That fact that it occurs is surprising.

When I remove all reference to tls and certs, the redirect disappears.

Where is this behavior coming from? Where is it documented and explained?

Perhaps we can imagine that it makes sense to assume you’d want such a redirect, whenever you install TLS certs. Otherwise why are you installing certs.

Thanks.



This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Hi Sam,

according to the Ingress Nginx docs: https://kubernetes.github.io/ingress-nginx/user-guide/tls/#server-side-https-enforcement-through-redirect

By default the controller redirects HTTP clients to the HTTPS port 443 using a 308 Permanent Redirect response if TLS is enabled for that Ingress.

This can be disabled globally using ssl-redirect: "false" in the NGINX config map, or per-Ingress with the nginx.ingress.kubernetes.io/ssl-redirect: "false" annotation in the particular resource.

If TLS is defined, most people want to use HTTPS exclusively and this redirection seems to be the default behavior as soon as you enable TLS. Use the above annotation to disable it if you don’t want/need it.

Daniel, Founder of Deckrun

Hey!

I believe this behavior comes from the default NGINX Ingress Controller that DOKS uses. When you add a tls: section to your Ingress, it kind of assumes you want HTTPS and starts redirecting HTTP to HTTPS automatically, even if the cert is just the default “Fake Certificate.”

I don’t think this is triggered by cert-manager itself, but more like built into how the ingress controller handles TLS. You can probably disable it by adding this annotation:

nginx.ingress.kubernetes.io/ssl-redirect: "false"

I don’t think that it is documented in the DOKS docs, but I guess it makes sense that it’d behave this way when TLS is present.

- Bobby

The developer cloud

Scale up as you grow — whether you're running one virtual machine or ten thousand.

Get started for free

Sign up and get $200 in credit for your first 60 days with DigitalOcean.*

*This promotional offer applies to new accounts only.