Kubernetes入口编辑：HTTP 400错误请求-普通的HTTP请求已发送到HTTPS

Question

Could there be any reason why a webapp which perfectly loads up fine gives a *HTTP 400 Bad request - The plain HTTP request was sent to HTTPS* port after the webapp's ingress has been edited manually or edited through an automated job which updates the ingress modifying the Whitelisted IPs

Apparently, this issue gets fixed when we redeploy the webapp after purging the webapp deployment ...

Any pointers to this would be great as this happens on our PROD env and not reproducible on any lower envs. Points to note:- - Nginx Ingress controller setup is the same across lower envs and Prod env.

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    ingress.kubernetes.io/force-ssl-redirect: "true"
    ingress.kubernetes.io/ingress.allow-http: "false"
    ingress.kubernetes.io/proxy-body-size: 20M
    ingress.kubernetes.io/secure-backends: "true"
    ingress.kubernetes.io/whitelist-source-range: xxx.yy.zz.pp/32, yyy.ss.dd.kkl/32
    ingress.kubernetes.io/whitelist-source-range-status: unlocked
creationTimestamp: 2018-11-29T15:34:05Z
generation: 5
 labels:
   app: xyz-abc-pqr
  name: xxxx-webapp-yyyy-zzzz
  namespace: nspsace-name
  resourceVersion: "158237270"
  selfLink: /apis/extensions/v1beta1/namespaces/nspsace-name/ingresses/xxxx-webapp-yyyy-zzzz
  uid: 348f892e-f3ec-11e8-aa6f-0a0340041348
  spec:
   rules:
    - host: ssssssss.wwwwweewwerwerw.co.uk
      http:
      paths:
       - backend:
          serviceName: xxxx-webapp-yyyy-zzzz
          servicePort: 443
        path: /
    - host: xxxx-webapp-yyyy-zzzz.bbbbv.lasdfkla.ajksdfh.ioohhsaf.pp
     http:
       paths:
        - backend:
          serviceName: xxxx-webapp-yyyy-zzzz
          servicePort: 443
       path: /
     tls:
       - hosts:
          - ssssssss.wwwwweewwerwerw.co.uk
          - xxxx-webapp-yyyy-zzzz.bbbbv.lasdfkla.ajksdfh.ioohhsaf.pp
         secretName: xxxx-webapp-yyyy-zzzz-server-tls
     status:
       loadBalancer:
        ingress:
         - {}

Answer 1

There may be something wrong with the ingress controller and how it updates its configuration. I'm assuming you are using a nginx ingress controller so you can inspect the configs before an after:

$ kubectl cp <nginx-ingress-controller-pod>:nginx.conf nginx.conf.before
$ kubectl edit ingress <your-ingress>
$ kubectl cp <nginx-ingress-controller-pod>:nginx.conf nginx.conf.after
$ diff nginx.conf.before nginx.conf.after

You can see the this may happen with nginx because of something like this: Dealing with nginx 400 "The plain HTTP request was sent to HTTPS port" error .