Invalid redirect port from http to https

[cristic83]

NGINX Ingress controller version:
gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.15
Kubernetes version (use kubectl version):
oc v3.6.1+008f2d5
kubernetes v1.6.1+5115d708d7

Environment:

• Cloud provider or hardware configuration: AWS
• OS (e.g. from /etc/os-release):
  NAME="Red Hat Enterprise Linux Server"
  VERSION="7.2 (Maipo)"
  ID="rhel"
  ID_LIKE="fedora"
  VERSION_ID="7.2"
  PRETTY_NAME="Red Hat Enterprise Linux Server 7.2 (Maipo)"
  ANSI_COLOR="0;31"
  CPE_NAME="cpe:/o:redhat:enterprise_linux:7.2:GA:server"
  HOME_URL="https://www.redhat.com/"
  BUG_REPORT_URL="https://bugzilla.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 7"
REDHAT_BUGZILLA_PRODUCT_VERSION=7.2
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="7.2"

• Kernel (e.g. uname -a):
  Linux ip-10-0-110-21.eu-west-1.compute.internal 3.10.0-327.el7.x86_64 Basic structure  #1 SMP Thu Oct 29 17:29:29 EDT 2015 x86_64 x86_64 x86_64 GNU/Linux

• Install tools:
  OpneShift

• Others:

What happened:
When configuring the nginx-controller with custom http and https ports and calling http://:${NGINX_HOST_HTTP_PORT}/health we got a redirect to https://:${NGINX_HOST_HTTP_PORT}/health instead of http://:${NGINX_HOST_HTTPS_PORT}/health

What you expected to happen:
The redirect should be performed to the https port, not to the http port.

How to reproduce it (as minimally and precisely as possible):

Launch an nginx-controller with the following args:

• --default-backend-service=$(POD_NAMESPACE)/default-http-backend
• --default-ssl-certificate=edcm/theglue-tls-secret
• --http-port=${NGINX_HOST_HTTP_PORT}
• --https-port=${NGINX_HOST_HTTPS_PORT}

Anything else we need to know:

[aledbf]

@cristic83 this works as expected. You are reaching the default server and by default it redirects to ssl.
What are you trying to do?

[cristic83]

Well, it redirects to SSL, which is ok, but it redirects on the wrong port: it should redirect on the ssl port, not on the normal one. E.g: if I make a request to http://mydomain:8080/health, it should redirect to https://mydomain:8843/health, provided that I configured the http port to be 8080 and the https port to be 8843.

[aledbf]

@cristic83 please enable use-port-in-redirects in the configuration configmap

[cristic83]

Can you please provide an example? The following settings for the args did not work:

args:
- /nginx-ingress-controller
- --default-backend-service=$(POD_NAMESPACE)/default-http-backend
- --default-ssl-certificate=edcm/theglue-tls-secret
- --http-port=${NGINX_HOST_HTTP_PORT}
- --https-port=${NGINX_HOST_HTTPS_PORT}
- --use-port-in-redirects=true

The pods don't start. The logs say: unknown flag: --use-port-in-redirects

Thanks,
Cristi

[pieterlange]

https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/configmap.md

[cristic83]

The same result (unknown flag: --nginx-configmap) using a config map like below:

[ec2-user@ip-10-0-110-21 ~]$ oc get configmap nginx-controller-conf -o yaml
apiVersion: v1
data:
use-port-in-redirects: "true"
kind: ConfigMap

[ec2-user@ip-10-0-110-21 ~]$ oc get daemonset nginx-ingress-lb -o yaml
apiVersion: extensions/v1beta1
kind: DaemonSet
...
- args:
- /nginx-ingress-controller
- --default-backend-service=$(POD_NAMESPACE)/default-http-backend
- --http-port=8080
- --https-port=8843
- --nginx-configmap=$(POD_NAMESPACE)/nginx-controller-conf

[ec2-user@ip-10-0-110-21 ~]$ oc get daemonset nginx-ingress-lb
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE-SELECTOR AGE
nginx-ingress-lb 4 4 0 4 0 2m

[ec2-user@ip-10-0-110-21 ~]$ oc logs nginx-ingress-lb-hn8jz
unknown flag: --nginx-configmap

I've used the flag --nginx-configmap as described in here: https://github.com/kubernetes/contrib/blob/master/ingress/controllers/nginx/examples/custom-configuration/rc-custom-configuration.yaml

[aledbf]

@cristic83 the flag name is --configmap.
Please don't use the docs from other repositories. This one contains all the information

[cristic83]

Thanks, for your suggestion, but it still does not work:

[ec2-user@ip-10-0-110-21 ~]$ oc get daemonset nginx-ingress-lb -o yaml
apiVersion: extensions/v1beta1
kind: DaemonSet
spec:
selector:
matchLabels:
name: nginx-ingress-lb
template:
metadata:
creationTimestamp: null
labels:
name: nginx-ingress-lb
spec:
containers:
- args:
- /nginx-ingress-controller
- --default-backend-service=$(POD_NAMESPACE)/default-http-backend
- --default-ssl-certificate=edcm/theglue-tls-secret
- --http-port=8080
- --https-port=8843
- --configmap=$(POD_NAMESPACE)/nginx-controller-conf

[ec2-user@ip-10-0-110-21 ~]$ oc get configmap nginx-controller-conf -o yaml
apiVersion: v1
data:
use-port-in-redirects: "true"
kind: ConfigMap

[ec2-user@ip-10-0-110-21 ~]$ curl -v mydomain:8080/health

• About to connect() to mydomain port 8080 (#0)
• Trying 127.0.0.1...
• Connected to mydomain (127.0.0.1) port 8080 (#0)

GET /health HTTP/1.1
User-Agent: curl/7.29.0
Host: mydomain:8080
Accept: /

< HTTP/1.1 301 Moved Permanently
< Server: nginx/1.13.5
< Date: Tue, 28 Nov 2017 11:47:49 GMT
< Content-Type: text/html
< Content-Length: 185
< Connection: keep-alive
< Location: https://mydomain:8080/health
< Strict-Transport-Security: max-age=15724800; includeSubDomains;
<

• Connection #0 to host mydomain left intact

[ec2-user@ip-10-0-110-21 ~]$ oc get ingress my-ingress
NAME HOSTS ADDRESS PORTS AGE
my-ingress mydomain 10.0.110.21,1... 80, 443 3d

[aledbf]

@cristic83 please use quay.io/aledbf/nginx-ingress-controller:0.296
(that image includes the port when is not 443)

[gongycn]

This problem still exists in the latest 0.32 version