HTTP to HTTPS redirect with kong-ingress and TLS-offloading

#1

Hi all.

I’m having issues setting up HTTP to HTTPS redirect on the kong ingress while using AWS ELB (classic) and HTTPS listener for TLS offloading. With the current configuration no matter whether the request arrives via HTTP or HTTPS kong issues 302 redirect. By the looks of it Kong is not handling the X-Forward-Proto header supplied by the ELB.

I have followed the posts in the forum about similar issue (Redirecting HTTP to HTTPS) but so far it doesn’t seem that anyone had success implementing proper HTTP to HTTPS redirect with TLS offloading or am I configuring Kong incorrectly?

Thanks in advance for any hints!

The Kong ingress is provisioned using the stable/kong Helm chart.
Some relevant bits from values.yaml:

proxy:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
    service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "3600"
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:eu-west-2:XXXX
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: 443
  http:
    enabled: true
    servicePort: 80
    containerPort: 8000
  tls:
    enabled: true
    servicePort: 443
    containerPort: 8443
    overrideServiceTargetPort: 8000 # <=

---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: adminer
  annotations:
    kubernetes.io/ingress.class: kong
    configuration.konghq.com: ingress-api
spec:
  rules:
    - host: XXXX
      http:
        paths:
          - path: /
            backend:
              serviceName: adminer
              servicePort: 80

apiVersion: configuration.konghq.com/v1
kind: KongIngress
metadata:
  name: ingress-api
route:
  protocols:
    - https
  https_redirect_status_code: 302
Kong Ingress Annotations (Redirect)
#2

You need to set KONG_TRUSTED_IPS environment variable so that Kong trusts the headers sent by ELB:

#3

Hi @hbagdi @thecodingrobot

I have the same issue. Were you able to resolve it?

Ingress and KongIngress definitions:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: "2048-ingress"
  namespace: "2048-game"
  annotations:
    kubernetes.io/ingress.class: kong
    kubernetes.io/tls-acme: "true"
    configuration.konghq.com: https-only
  labels:
    app: 2048-ingress
spec:
  rules:
    - host: 2048.test.com
      http:
        paths:
          - path: /
            backend:
              serviceName: "service-2048"
              servicePort: 80
---
apiVersion: configuration.konghq.com/v1
kind: KongIngress
metadata:
    name: https-only
    namespace: 2048-game
route:
  protocols:
  - https
  https_redirect_status_code: 302

Both HTTP and HTTPS are redirected causing loop.

sh-4.2$ curl -I http://2048.test.com
HTTP/1.1 302 Moved Temporarily
Date: Tue, 11 Feb 2020 16:07:26 GMT
Content-Type: text/html
Content-Length: 110
Connection: keep-alive
Location: https://2048.test.com
X-Kong-Response-Latency: 0
Server: kong/1.4.3

sh-4.2$ curl -I https://2048.test.com
HTTP/1.1 302 Moved Temporarily
Date: Tue, 11 Feb 2020 16:07:33 GMT
Content-Type: text/html
Content-Length: 110
Connection: keep-alive
Location: https://2048.test.com
X-Kong-Response-Latency: 1
Server: kong/1.4.3
#4

Can you set KONG_TRUSTED_IPS=0.0.0.0/0 and try?

#5

@hbagdi, thanks for reply. I have updated the ingress-kong deployment env variables to add the KONG_TRUSTED_IPS. Is that what you mean? The result is the same, both http and https is being redirected to https causing loop.

spec:
  containers:
  - env:
    - name: KONG_DATABASE
      value: "off"
    - name: KONG_NGINX_WORKER_PROCESSES
      value: "1"
    - name: KONG_NGINX_HTTP_INCLUDE
      value: /kong/servers.conf
    - name: KONG_ADMIN_ACCESS_LOG
      value: /dev/stdout
    - name: KONG_ADMIN_ERROR_LOG
      value: /dev/stderr
    - name: KONG_ADMIN_LISTEN
      value: 127.0.0.1:8444 ssl
    - name: KONG_PROXY_LISTEN
      value: 0.0.0.0:8000, 0.0.0.0:8443 ssl http2
    - name: KONG_TRUSTED_IPS
      value: 0.0.0.0/0
#6 
KONG_TRUSTED_IPS=0.0.0.0/0,::/0

Can you change trusted ips to that?

To make sure, are you using ELB or NLB? ELB supports x-forwarded-proto and this should work with that configuration.

Kong correctly parses forwarded-proto and matches the route accordingly. I tested this locally to make sure of it.

#7

It worked! I’m using ELB. Only the http is redirected to https now, so loop issue was resolved. Thanks a lot @hbagdi.

#8

We should add this to docs somewhere. I’m not sure where though.

#9

I’ve been able to confirm this works in my use case. However, I’m wondering how this would work in the context of a Helm chart. Looking through the templates, it doesn’t seem supported.

Would it be useful if I created a PR to allow this as an env parameter?

#10

Looks like this is already handled here

© 2019 Kong Inc.    Terms  •  Privacy  •  FAQ