HTTP to HTTPS Redirect Issue: Infinite loop issue with Custom Query Param

[yks0000]

I am trying to create a HTTP to HTTPS redirect following doc here

Below is the config

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig":
      { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
    alb.ingress.kubernetes.io/backend-protocol: HTTPS
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-west-2:xxxxxx:certificate/023f915c-bb63-4eed-b65a-c8b901eb4875
    alb.ingress.kubernetes.io/healthcheck-path: /swagger.json
    alb.ingress.kubernetes.io/healthcheck-protocol: HTTPS
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS": 443}, {"HTTP": 80}]'
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/security-groups: sg-0axxxxd2,sg-0axxxxb3d
    alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS-1-2-2017-01
    alb.ingress.kubernetes.io/subnets: SubnetAz1, SubnetAz2, SubnetAz3
    alb.ingress.kubernetes.io/success-codes: "200"
    kubernetes.io/ingress.class: alb
  labels:
    app: swagger-ingress
  name: swagger-ingress
  namespace: swagger-api-ppd-qal
spec:
  rules:
  - host: swagger-doc.api.devops.int
    http:
      paths:
      - backend:
          serviceName: ssl-redirect
          servicePort: use-annotation
        path: /
      - backend:
          serviceName: swagger-service
          servicePort: 443
        path: /

while applying this kubectl apply -f swagger-ingress.yaml and describing the ingress, I see below error message

Warning ERROR 34s (x12 over 63m) ingress-controller Error instantiating target groups: Unable to find the swagger-api-ppd-qal/ssl-redirect service

I verified in AWS console and does not see redirect rule on HTTP listener. Also, I am not sure why Ingress Controller is trying to find swagger-api-ppd-qal/ssl-redirect service here.

Am I missing something, please suggest.

K8S Version: 1.14.6

[cesarokuti]

Maybe you need to put annotation alb.ingress.kubernetes.io/target-type: instance if use service-type NodePort or alb.ingress.kubernetes.io/target-type: ip to use service-type ClusterIP.

The name swagger-api-ppd-qal/ssl-redirect are your namespace and serviceName.

[yks0000]

@cesarokuti I noticed another issue with Redirects. If I put a override for Query Param, Ingress Controller goes in infinite loops

'{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301", "Query": "albRedirect=true&#{query}"}}'

We are adding this additional albRedirect to know if client tried to use a HTTP instead of HTTPS.

[yks0000]

@M00nF1sh @cesarokuti Any help on this?

[agconti]

@yks0000 I had this same problem too. After tons of searching, I found this setup which works for me: #487 (comment)

[yks0000]

@agconti Thanks for sharing. However, Issue I have is when I use custom query parameters and ingress controller goes in Infinite loop ie #1055 (comment)

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[yks0000]

Issue is not yet resolved for me.

[dtherhtun]

same with me. url isn't redirect to https

[shrivastavshubham34]

I'm having Having SSL redirect issues as well.Followed the documentation below
https://kubernetes-sigs.github.io/aws-alb-ingress-controller/guide/tasks/ssl_redirect/

[manikandanrapyder]

@shrivastavshubham34 I also found the same issue while the same documentation. Did you resolved it?

[shrivastavshubham34]

@shrivastavshubham34 I also found the same issue while the same documentation. Did you resolved it?

Hey yes I was able to resolve it.
By moving ssl redirect route to last entry in the ingress file.
Shifting its position should fix the problem

[manikandanrapyder]

@shrivastavshubham34 This was my annotations, as you mentioned i have set ssl-redirect to last still the error is there. Do you find anything wrong with the annotations?

    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/target-type: instance
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:XXXXX:YYYYY
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP:80"},{"HTTPS":443}]'
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'

[shrivastavshubham34]

You need to add couple of other params as well

    kubernetes.io/ingress.class: albcm
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:xxxxxxxxxx:certificate/xxxxxxxxx
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
    alb.ingress.kubernetes.io/backend-protocol: HTTPS
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
    alb.ingress.kubernetes.io/healthcheck-protocol: HTTPS
    alb.ingress.kubernetes.io/healthcheck-path: /api/health_check
    alb.ingress.kubernetes.io/scheme: internet-facing 
    alb.ingress.kubernetes.io/tags: Environment=dev

In spec rules ssl-redirect should be either last or 2nd last whichever works for you

spec:
  rules:
    - host: example.com
      http:
        paths:
          - path: /agent
            backend:
              serviceName: agent-service
              servicePort: 4453
          - path: /*
            backend:
              serviceName: ssl-redirect
              servicePort: use-annotation  

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.