Update ingress.yaml to accomodate kong service ports #10086
Conversation
This template built an ingress that incorrectly chose the kong-proxy service port based on `app.ingress.tls.enabled`. This fixes that by using the `kong.proxy.tls.enabled` for the check instead, selecting the correct service port. It also adjusts the default annotations to add checks for `app.ingress.tls.enabled` so unnecessary annotations are avoided. Signed-off-by: Josh Preston <[email protected]>
The committers listed above are authorized under a signed CLA. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mrjoshuap The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
cncf-cla: no
|
Welcome @mrjoshuap! |
k8s-ci-robot
added
size/S
|
This sort of extends the fix applied in #9863 |
This template built an ingress that incorrectly set
$servicePortbased onapp.ingress.tls.enabled.This fixes that by using the
kong.proxy.tls.enabledfor the check instead, thereby selecting the correct service port.It also adjusts the default annotations to check for
app.ingress.tls.enabledso unnecessary annotations are avoided.Finally, it properly sets the backend protocol based on
kong.proxy.tls.enabled.I see a few different scenarios:
SSL Passthrough
app.ingress.tls.enabled==falsekong.proxy.tls.enabled==trueIngress terminated TLS
app.ingress.tls.enabled==truekong.proxy.tls.enabled==falseIngress TLS to Kong TLS, though not sure this works because the default ingress annotation
nginx.ingress.kubernetes.io/ssl-redirect: "true"app.ingress.tls.enabled==truekong.proxy.tls.enabled==trueI don't think HTTP to HTTPS proxying is a good idea, so I won't talk more about it.
To fix TLS to TLS, there might be a need to add an additional parameter enabling
ssl-passthroughbehavior. In this implementation, ifkong.proxy.tls.enabled=truethen it assumes you want to perform SSL-passthrough. I haven't verified as I'm using Ingress terminated TLS and can't test the needful.I suspect this has been the culprit of many threads regarding
Error 400 HTTP request to HTTPS, though I think that might also have something to do with http2 requirements on the proxy -- at least on my deployment.