在 GKE 上自动将 HTTP 重定向到 HTTPS

Question

I used Google-managed SSL certificate on GKE for set up SSL for my website. This is working example.com (that is insecure) and working also https://example.com(that is secure). when i access my website example.com why it's not redirect to https://example.com ? I used below yaml file to set up ssl.

 apiVersion:.networking.gke.io/v1 kind: ManagedCertificate metadata: name: certificate-name spec: domains: - domain-name1 - domain-name2

Answer 1

There is now a supported way of doing this in GKE with Frontend Config: https://cloud.google.com/kube.netes-engine/docs/how-to/ingress-features#https_redirect

You will need GKE version at least 1.18.10-gke.600 .

EDIT: As per comment by @mltsy, it also works in 1.17.17 .

How we have it set up is:

apiVersion: networking.gke.io/v1beta2
kind: ManagedCertificate
metadata:
  name: <certificate-name>
spec:
  domains:
    - example.com
---
apiVersion: networking.gke.io/v1beta1
kind: FrontendConfig
metadata:
  name: <config-name>
spec:
  redirectToHttps:
    enabled: true
    responseCodeName: MOVED_PERMANENTLY_DEFAULT
---
kind: Ingress
apiVersion: networking.k8s.io/v1beta1
metadata:
  name: <ingress-name>
  annotations:
    kubernetes.io/ingress.class: "gce"
    networking.gke.io/managed-certificates: <certificate-name>
    kubernetes.io/ingress.global-static-ip-name: <ip-name>
    networking.gke.io/v1beta1.FrontendConfig: <config-name>
  labels:
    <labels-to-specify-app>
spec:
  rules:
    - host: example.com
      http:
        paths:
          - path: /*
            backend:
              serviceName: <service-name>
              servicePort: 80

Answer 2

GKE ingress doesn't support HTTP to HTTPS redirect at this time. You can take a look at this Stack post . However, you can create a redirection rule for your Ingress resource using setting up an HTTP-to-HTTPS redirect for external HTTP(S) load balancers.

As per document you can disable HTTP by including the kube.netes.io/ingress.allow-http annotation in your Ingress manifest.

annotations:
kubernetes.io/ingress.allow-http: "false"