ingress: adds configurable SSL redirect nginx controller #850

simonswine · 2016-04-26T16:36:40Z

Hi everyone,

I want my services behind the ingress to decide if HTTPS is strictly required or not. So I added the feature to disable the 301 redirect to the https:/ URL.

To make this actually work #849 needs to be merged before. (Otherwise you cannot override and default value true with a false)

Cheers,

Christian

aledbf · 2016-04-26T16:39:41Z

@simonswine I fixed that issue in #766 (not merged yet) using use-hts=false in the configmap

simonswine · 2016-04-26T16:47:41Z

Hi @aledbf, I missed your work on that. I am not too sure why it's not merged. I guess your PR is rather large and doing a lot of different things.

How and where exactly did you solve the default value overriding problem with bool (default=true) and you want to have it set false via ConfigMap. See fix + tests in #849

bprashanth · 2016-05-02T00:06:33Z

ingress/controllers/nginx/nginx/main.go

@@ -256,6 +259,7 @@ func newDefaultNginxCfg() nginxConfiguration {
 		SSLBufferSize:            sslBufferSize,
 		SSLCiphers:               sslCiphers,
 		SSLProtocols:             sslProtocols,
+		SSLRedirect:              true,


please update the docs on how we flip this

bprashanth · 2016-05-02T00:07:27Z

I'm fine with a smaller change, doens't matter either way how it gets in i guess, as long as we alll agree on how it's expressed. You and @aledbf can choose which one of the 2 prs goes in :)

aledbf · 2016-05-04T17:36:45Z

@simonswine please check the latest version gcr.io/google_containers/nginx-ingress-controller:0.61. Contains #766 and #849. Use hts=false in the nginx configmap.

simonswine · 2016-05-05T10:49:29Z

@aledbf thanks for that update. Thinking a bit about it, I came to the conclusion that we probably want to be able to configure HSTS, and server-side SSL redirect enforcement separately.

For my particular use case I want to be always able to access something via HTTP (if the clients wants to do so). It's needed for doing the http-01 challenge for Let's Encrypt. At the same time I want to be able to enforce HTTPS via HSTS for client that support that. Ultimately I want to be able to do that on location level (see #904).

aledbf · 2016-05-08T22:17:20Z

I came to the conclusion that we probably want to be able to configure HSTS, and server-side SSL redirect enforcement separately.

Yes, you are right about this. How about defining the redirect and hsts in the configuration to define a default value and adding an annotation in the services? This way is possible to just enable things like http-01 challenge and force the behavior with tls rules with existing certificates

rh-kube-bot · 2016-05-16T15:31:15Z

Can one of the admins verify this patch?

rh-kube-bot · 2016-05-16T19:34:19Z

Can one of the admins verify this patch?

simonswine · 2016-05-25T18:13:01Z

add global value to config map
add per service value as annotation to service object (ingress-nginx.kubernetes.io/ssl-redirect: "false")

@aledbf could please take a look at my changes. They are still a WiP. It felt like it is a bit messy implemented.

Definitely missing are docs

aledbf · 2016-05-25T18:33:32Z

@simonswine looks good 👍
I like the getServiceAnnotations addition. Can you make this public? (some of the pending PR like the auth are located in a different package)

Just the server.SetCfg(cfgCamelCase) before the template is what I don't "like". If the user specifies --v=3 it will log the content of the map before the rendering of the template with the cfg repeated N times (one per server)

aledbf · 2016-05-25T19:06:06Z

@simonswine why not the annotation in the ingress instead of the service?

simonswine · 2016-05-26T09:14:08Z

@aledbf

why not the annotation in the ingress instead of the service?

As I want it to be able to config stuff on Location-level. If this has to be done with ingress controller annotations, their key has to contain the path as well. This felt a bit ugly.

SetCfg/cfg in Server struct

It's modified now:

the struct field is public
we use a pointer instead of a map

GetServiceAnnotations

Is now public

Docs

added

simonswine · 2016-05-27T09:13:35Z

@eparis IMHO now ready to merge

aledbf · 2016-05-27T20:20:26Z

their key has to contain the path as well....

Why, just create a restriction: using this annotation in an ingress rules applies to all the paths
(if I want multiple paths with the same host I just need to create multiple rules with 1 path)

As I want it to be able to config stuff on Location-level....

I know, but if the annotation is in the service and not the ingress rule then:

There's two places to indicate a "routing" behavior, ingress rule and service.
If the annotation is in the service I cannot create two rules with different behavior using the same service (I need to duplicate the service)

aledbf · 2016-05-31T21:22:58Z

@simonswine can you rebase?
I'm working on #1104 and I would really love to get this merged

simonswine · 2016-06-03T14:27:53Z

@aledbf sorry I haven't managed to get this done before 0.7.

I can see your point in the ingress vs. service resource discussion. It feels cleaner to me now to do it in the ingress. I will modify this accordingly..

* add global value to config map * add per ingress value as annotation to ingress resources

simonswine · 2016-06-05T15:27:26Z

@aledbf @bprashanth

Refactored the code to use ingress resource annotations. It is now part of rewrite package.

Moved config into own package to prevent dependency cycles in the imports

bprashanth · 2016-06-06T23:09:37Z

ingress/controllers/nginx/nginx/config/config.go

+
+	// SSL enabled protocols to use
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
+	sslProtocols = "TLSv1 TLSv1.1 TLSv1.2"


I know this is just cut/paste, but why include tls1 as a default?

@bprashanth please do not change this. Some clients do not support 1.1 or 1.2
https://www.ssllabs.com/ssltest/viewClient.html?name=IE&version=8-10&platform=Win%207&key=113
https://www.ssllabs.com/ssltest/viewClient.html?name=Java&version=7u25&key=26

I was suggesting an opt in, not default. I'm ok if we really need it, but tls 1 is compromised and people can just force a downgrade and BEAST. Please add a comment.

@bprashanth just in case the defaults in sslCiphers and sslProtocols mitigate BEAST

(screenshot from ssllabs.com/ssltest/analyze.html of a site with defaults)

alright, SG, lets add it to the readme somewhere?

done https://github.com/kubernetes/contrib/pull/1130/files#diff-fe655fff02ea60cf264edabc9551b1b8R376

bprashanth · 2016-06-06T23:10:17Z

LGTM but for the nit, thanks for the package cleanup also

aledbf · 2016-06-07T13:35:49Z

LGTM

bprashanth · 2016-06-08T17:25:20Z

Spinoff pr for docs sounds good, merging

googlebot added the cla: yes label Apr 26, 2016

bprashanth reviewed May 2, 2016
View reviewed changes

simonswine force-pushed the feature-ssl-redirect branch from 05982e4 to 303f873 Compare May 5, 2016 10:44

simonswine force-pushed the feature-ssl-redirect branch from 303f873 to 45c3ef4 Compare May 25, 2016 18:10

simonswine changed the title ~~Adds configurable SSL redirect to Nginx Ingress Controller~~ ingress: adds configurable SSL redirect nginx controller May 25, 2016

simonswine changed the title ~~ingress: adds configurable SSL redirect nginx controller~~ [WiP] ingress: adds configurable SSL redirect nginx controller May 25, 2016

simonswine force-pushed the feature-ssl-redirect branch from 45c3ef4 to c6ed811 Compare May 26, 2016 09:12

eparis added the area/ingress label May 26, 2016

simonswine changed the title ~~[WiP] ingress: adds configurable SSL redirect nginx controller~~ ingress: adds configurable SSL redirect nginx controller May 27, 2016

simonswine force-pushed the feature-ssl-redirect branch from c6ed811 to 505bc16 Compare June 5, 2016 14:22

simonswine added 2 commits June 5, 2016 15:29

Refactor nginx config into own package

9342b9d

ingress: adds configurable SSL redirect nginx controller

6fdd444

* add global value to config map * add per ingress value as annotation to ingress resources

simonswine force-pushed the feature-ssl-redirect branch from 505bc16 to 6fdd444 Compare June 5, 2016 14:30

bprashanth reviewed Jun 6, 2016
View reviewed changes

simonswine mentioned this pull request Jun 8, 2016

[nginx-ingress-controller] Improve docs and examples #1130

Merged

bprashanth merged commit 1ec21d8 into kubernetes-retired:master Jun 8, 2016

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ingress: adds configurable SSL redirect nginx controller #850

ingress: adds configurable SSL redirect nginx controller #850

simonswine commented Apr 26, 2016

aledbf commented Apr 26, 2016

simonswine commented Apr 26, 2016

bprashanth May 2, 2016

bprashanth commented May 2, 2016

aledbf commented May 4, 2016

simonswine commented May 5, 2016

aledbf commented May 8, 2016

rh-kube-bot commented May 16, 2016

rh-kube-bot commented May 16, 2016

simonswine commented May 25, 2016 •

edited

Loading

aledbf commented May 25, 2016

aledbf commented May 25, 2016

simonswine commented May 26, 2016 •

edited

Loading

simonswine commented May 27, 2016

aledbf commented May 27, 2016

aledbf commented May 31, 2016

simonswine commented Jun 3, 2016

simonswine commented Jun 5, 2016

bprashanth Jun 6, 2016

aledbf Jun 6, 2016

bprashanth Jun 7, 2016

aledbf Jun 7, 2016

bprashanth Jun 8, 2016

aledbf Jun 8, 2016

bprashanth commented Jun 6, 2016

aledbf commented Jun 7, 2016

bprashanth commented Jun 8, 2016

ingress: adds configurable SSL redirect nginx controller #850

ingress: adds configurable SSL redirect nginx controller #850

Conversation

simonswine commented Apr 26, 2016

aledbf commented Apr 26, 2016

simonswine commented Apr 26, 2016

bprashanth May 2, 2016

Choose a reason for hiding this comment

bprashanth commented May 2, 2016

aledbf commented May 4, 2016

simonswine commented May 5, 2016

aledbf commented May 8, 2016

rh-kube-bot commented May 16, 2016

rh-kube-bot commented May 16, 2016

simonswine commented May 25, 2016 • edited Loading

aledbf commented May 25, 2016

aledbf commented May 25, 2016

simonswine commented May 26, 2016 • edited Loading

simonswine commented May 27, 2016

aledbf commented May 27, 2016

aledbf commented May 31, 2016

simonswine commented Jun 3, 2016

simonswine commented Jun 5, 2016

bprashanth Jun 6, 2016

Choose a reason for hiding this comment

aledbf Jun 6, 2016

Choose a reason for hiding this comment

bprashanth Jun 7, 2016

Choose a reason for hiding this comment

aledbf Jun 7, 2016

Choose a reason for hiding this comment

bprashanth Jun 8, 2016

Choose a reason for hiding this comment

aledbf Jun 8, 2016

Choose a reason for hiding this comment

bprashanth commented Jun 6, 2016

aledbf commented Jun 7, 2016

bprashanth commented Jun 8, 2016

simonswine commented May 25, 2016 •

edited

Loading

simonswine commented May 26, 2016 •

edited

Loading