Skip to content

Commit 7ff1715

Browse files
author
Chris Henderson
committed
Add support for 301 redirect to https
1 parent ab4c7ae commit 7ff1715

File tree

11 files changed

+49
-2
lines changed

11 files changed

+49
-2
lines changed

‎examples/customization/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ The table below summarizes some of the options. More options (extensions) are av
1818
| N/A | `server-names-hash-bucket-size` | Sets the value of the [server_names_hash_max_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_max_size) directive. | Depends on the size of the processor’s cache line. |
1919
| N/A | `server-names-hash-max-size` | Sets the value of the [server_names_hash_bucket_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_bucket_size) directive. | `512` |
2020
| `nginx.org/http2` | `http2` | Enables HTTP/2 in servers with SSL enabled. To support HTTP/2 for Chrome users, use the provided controller image based on the alpine Linux. It includes OpenSSL with ALPN support, [necessary for Chrome users](https://www.nginx.com/blog/supporting-http2-google-chrome-users/). | `False` |
21+
| `nginx.org/redirect-to-https` | `redirect-to-https` | Sets the 301 redirect rule based on the value of the `http_x_forwarded_proto` header on the server block to force incoming traffic to be over HTTPS. Useful when terminating SSL in a load balancer in front of the Ingress controller — see [115](https://github.com/nginxinc/kubernetes-ingress/issues/115) | `False` |
2122
| N/A | `log-format` | Sets the custom [log format](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format). | See the [template file](../../nginx-controller/nginx/nginx.conf.tmpl). |
2223
| `nginx.org/hsts` | `hsts` | Enables [HTTP Strict Transport Security (HSTS)](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/): the HSTS header is added to the responses from backends. The `preload` directive is included in the header. | `False` |
2324
| `nginx.org/hsts-max-age` | `hsts-max-age` | Sets the value of the `max-age` directive of the HSTS header. | `2592000` (1 month) |

‎nginx-controller/controller/controller.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -405,6 +405,13 @@ func (lbc *LoadBalancerController) syncCfgm(key string) {
405405
cfg.HTTP2 = HTTP2
406406
}
407407
}
408+
if redirectToHTTPS, exists,err := nginx.GetMapKeyAsBool(cfgm.Data, "redirect-to-https", cfgm); exists {
409+
if err != nil {
410+
glog.Error(err)
411+
} else {
412+
cfg.RedirectToHTTPS = redirectToHTTPS
413+
}
414+
}
408415

409416
// HSTS block
410417
if hsts, exists, err := nginx.GetMapKeyAsBool(cfgm.Data, "hsts", cfgm); exists {

‎nginx-controller/nginx/config.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ type Config struct {
77
ProxyReadTimeout string
88
ClientMaxBodySize string
99
HTTP2 bool
10+
RedirectToHTTPS bool
1011
MainServerNamesHashBucketSize string
1112
MainServerNamesHashMaxSize string
1213
MainLogFormat string

‎nginx-controller/nginx/configurator.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ func (cnf *Configurator) generateNginxCfg(ingEx *IngressEx, pems map[string]stri
111111
Name: serverName,
112112
ServerTokens: ingCfg.ServerTokens,
113113
HTTP2: ingCfg.HTTP2,
114+
RedirectToHTTPS: ingCfg.RedirectToHTTPS,
114115
ProxyProtocol: ingCfg.ProxyProtocol,
115116
HSTS: ingCfg.HSTS,
116117
HSTSMaxAge: ingCfg.HSTSMaxAge,
@@ -162,6 +163,7 @@ func (cnf *Configurator) generateNginxCfg(ingEx *IngressEx, pems map[string]stri
162163
Name: emptyHost,
163164
ServerTokens: ingCfg.ServerTokens,
164165
HTTP2: ingCfg.HTTP2,
166+
RedirectToHTTPS: ingCfg.RedirectToHTTPS,
165167
ProxyProtocol: ingCfg.ProxyProtocol,
166168
HSTS: ingCfg.HSTS,
167169
HSTSMaxAge: ingCfg.HSTSMaxAge,
@@ -232,6 +234,13 @@ func (cnf *Configurator) createConfig(ingEx *IngressEx) Config {
232234
ingCfg.HTTP2 = HTTP2
233235
}
234236
}
237+
if redirectToHTTPS, exists, err := GetMapKeyAsBool(ingEx.Ingress.Annotations, "nginx.org/redirect-to-https", ingEx.Ingress); exists {
238+
if err != nil {
239+
glog.Error(err)
240+
} else {
241+
ingCfg.RedirectToHTTPS = redirectToHTTPS
242+
}
243+
}
235244
if proxyBuffering, exists, err := GetMapKeyAsBool(ingEx.Ingress.Annotations, "nginx.org/proxy-buffering", ingEx.Ingress); exists {
236245
if err != nil {
237246
glog.Error(err)

‎nginx-controller/nginx/ingress.tmpl‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,11 @@ server {
3434
proxy_hide_header Strict-Transport-Security;
3535
add_header Strict-Transport-Security "max-age={{$server.HSTSMaxAge}}; {{if $server.HSTSIncludeSubdomains}}includeSubDomains; {{end}}preload" always;{{end}}
3636
{{- end}}
37+
{{- if $server.RedirectToHTTPS}}
38+
if ($http_x_forwarded_proto = 'http') {
39+
return 301 https://$host$request_uri;
40+
}
41+
{{- end}}
3742

3843
{{range $location := $server.Locations}}
3944
location {{$location.Path}} {
@@ -50,7 +55,7 @@ server {
5055
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
5156
proxy_set_header X-Forwarded-Host $host;
5257
proxy_set_header X-Forwarded-Port $server_port;
53-
proxy_set_header X-Forwarded-Proto $scheme;
58+
proxy_set_header X-Forwarded-Proto {{if $server.RedirectToHTTPS}}https{{else}}$scheme{{end}};
5459

5560
proxy_buffering {{if $location.ProxyBuffering}}on{{else}}off{{end}};
5661
{{- if $location.ProxyBuffers}}

‎nginx-controller/nginx/nginx.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ type Server struct {
4747
SSLCertificate string
4848
SSLCertificateKey string
4949
HTTP2 bool
50+
RedirectToHTTPS bool
5051
ProxyProtocol bool
5152
HSTS bool
5253
HSTSMaxAge int64

‎nginx-plus-controller/controller/controller.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -409,6 +409,13 @@ func (lbc *LoadBalancerController) syncCfgm(key string) {
409409
cfg.HTTP2 = HTTP2
410410
}
411411
}
412+
if redirectToHTTPS, exists,err := nginx.GetMapKeyAsBool(cfgm.Data, "redirect-to-https", cfgm); exists {
413+
if err != nil {
414+
glog.Error(err)
415+
} else {
416+
cfg.RedirectToHTTPS = redirectToHTTPS
417+
}
418+
}
412419

413420
// HSTS block
414421
if hsts, exists, err := nginx.GetMapKeyAsBool(cfgm.Data, "hsts", cfgm); exists {

‎nginx-plus-controller/nginx/config.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ type Config struct {
77
ProxyReadTimeout string
88
ClientMaxBodySize string
99
HTTP2 bool
10+
RedirectToHTTPS bool
1011
MainServerNamesHashBucketSize string
1112
MainServerNamesHashMaxSize string
1213
MainLogFormat string

‎nginx-plus-controller/nginx/configurator.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ func (cnf *Configurator) generateNginxCfg(ingEx *IngressEx, pems map[string]stri
120120
Name: serverName,
121121
ServerTokens: ingCfg.ServerTokens,
122122
HTTP2: ingCfg.HTTP2,
123+
RedirectToHTTPS: ingCfg.RedirectToHTTPS,
123124
ProxyProtocol: ingCfg.ProxyProtocol,
124125
HSTS: ingCfg.HSTS,
125126
HSTSMaxAge: ingCfg.HSTSMaxAge,
@@ -176,6 +177,7 @@ func (cnf *Configurator) generateNginxCfg(ingEx *IngressEx, pems map[string]stri
176177
Name: serverName,
177178
ServerTokens: ingCfg.ServerTokens,
178179
HTTP2: ingCfg.HTTP2,
180+
RedirectToHTTPS: ingCfg.RedirectToHTTPS,
179181
ProxyProtocol: ingCfg.ProxyProtocol,
180182
HSTS: ingCfg.HSTS,
181183
HSTSMaxAge: ingCfg.HSTSMaxAge,
@@ -251,6 +253,13 @@ func (cnf *Configurator) createConfig(ingEx *IngressEx) Config {
251253
ingCfg.HTTP2 = HTTP2
252254
}
253255
}
256+
if redirectToHTTPS, exists,err := GetMapKeyAsBool(ingEx.Ingress.Annotations, "nginx.org/redirect-to-https", ingEx.Ingress); exists {
257+
if err != nil {
258+
glog.Error(err)
259+
} else {
260+
ingCfg.RedirectToHTTPS = redirectToHTTPS
261+
}
262+
}
254263
if proxyBuffering, exists, err := GetMapKeyAsBool(ingEx.Ingress.Annotations, "nginx.org/proxy-buffering", ingEx.Ingress); exists {
255264
if err != nil {
256265
glog.Error(err)

‎nginx-plus-controller/nginx/ingress.tmpl‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,11 @@ server {
4040
{{- if $server.HSTS}}
4141
add_header Strict-Transport-Security "max-age={{$server.HSTSMaxAge}}; {{if $server.HSTSIncludeSubdomains}}includeSubDomains; {{end}}preload" always;{{end}}
4242
{{- end}}
43+
{{- if $server.RedirectToHTTPS}}
44+
if ($http_x_forwarded_proto = 'http') {
45+
return 301 https://$host$request_uri;
46+
}
47+
{{- end}}
4348

4449
{{range $location := $server.Locations}}
4550
location {{$location.Path}} {
@@ -56,7 +61,7 @@ server {
5661
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
5762
proxy_set_header X-Forwarded-Host $host;
5863
proxy_set_header X-Forwarded-Port $server_port;
59-
proxy_set_header X-Forwarded-Proto $scheme;
64+
proxy_set_header X-Forwarded-Proto {{if $server.RedirectToHTTPS}}https{{else}}$scheme{{end}};
6065
proxy_buffering {{if $location.ProxyBuffering}}on{{else}}off{{end}};
6166
{{- if $location.ProxyBuffers}}
6267
proxy_buffers {{$location.ProxyBuffers}};

0 commit comments

Comments
 (0)