Redirect HTTP to HTTPS

To route HTTP traffic, you need to create an HTTPRoute or an Ingress resource pointing at your Kubernetes Service.

echo "
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: echo
  namespace: kong
  annotations:
    konghq.com/strip-path: 'true'
spec:
  parentRefs:
  - name: kong
    namespace: kong
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /echo
    backendRefs:
    - name: echo
      kind: Service
      port: 1027
" | kubectl apply -f -

echo "
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: echo
  namespace: kong
  annotations:
    konghq.com/strip-path: 'true'
spec:
  ingressClassName: kong
  rules:
  - http:
      paths:
      - path: /echo
        pathType: ImplementationSpecific
        backend:
          service:
            name: echo
            port:
              number: 1027
" | kubectl apply -f -

The routing configuration can include a certificate to present when clients connect over HTTPS. This is not required, as Kong Gateway will serve a default certificate if it cannot find another, but including TLS configuration along with routing configuration is typical.

1. Create a test certificate for the example.com hostname. This will be used to secure TLS traffic.

   OpenSSL 1.1.1+ OpenSSL 0.9.8

   openssl req -subj '/CN=example.com' -new -newkey rsa:2048 -sha256 \
      -days 365 -nodes -x509 -keyout server.key -out server.crt \
      -addext "subjectAltName = DNS:example.com" \
      -addext "keyUsage = digitalSignature" \
      -addext "extendedKeyUsage = serverAuth" 2> /dev/null;
      openssl x509 -in server.crt -subject -noout

   openssl req -subj '/CN=example.com' -new -newkey rsa:2048 -sha256 \
      -days 365 -nodes -x509 -keyout server.key -out server.crt \
      -extensions EXT -config <( \
       printf "[dn]\nCN=example.com\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:example.com\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth") 2>/dev/null;
      openssl x509 -in server.crt -subject -noout

   Older OpenSSL versions, including the version provided with macOS Monterey, require using the alternative version of this command.

2. Create a Secret containing the certificate:

    kubectl create secret -n kong tls example.com --cert=./server.crt --key=./server.key
   

3. Update your routing configuration to use this certificate:

   Gateway API Ingress

   kubectl patch -n kong --type=json gateway kong -p='[{
        "op":"add",
        "path":"/spec/listeners/-",
        "value":{
            "name":"proxy-ssl",
            "port":443,
            "protocol":"HTTPS",
            "tls":{
                "certificateRefs":[{
                    "group":"",
                    "kind":"Secret",
                    "name":"example.com"
                }]
            }
        }
    }]'
    

   kubectl patch -n kong --type json ingress echo -p='[{
        "op":"add",
    	"path":"/spec/tls",
    	"value":[{
            "hosts":["example.com"],
    		"secretName":"example.com"
        }]
    }]'

4. Send requests to verify if the configured certificate is served:

    curl -ksv https://example.com/echo --resolve example.com:443:$PROXY_IP 2>&1 | grep -A1 "certificate:"
   

   The results should look like this:

    * Server certificate:
    *  subject: CN=example.com
   

Kong Gateway handles HTTPS redirects by automatically issuing redirects to requests whose characteristics match an HTTPS-only route except for the protocol. For example, with a Kong Gateway Route like the following:

{ "protocols": ["https"], "hosts": ["example.com"],
  "https_redirect_status_code": 301, "paths": ["/echo/"], "name": "example" }

A request for http://example.com/echo/green receives a 301 response with a Location: https://example.com/echo/green header. Kubernetes resource annotations instruct the controller to create a route with protocols=[https] and https_redirect_status_code set to the code of your choice (the default if unset is 426).

1. Configure the protocols that are allowed in the konghq.com/protocols annotation:

   Gateway API Ingress

   kubectl annotate -n kong httproute echo konghq.com/protocols=https

   kubectl annotate -n kong ingress echo konghq.com/protocols=https

2. Configure the status code used to redirect in the konghq.com/https-redirect-status-code annotation:

   Gateway API Ingress

   kubectl annotate -n kong httproute echo konghq.com/https-redirect-status-code="301"

   kubectl annotate -n kong ingress echo konghq.com/https-redirect-status-code="301"

Note: Kong Ingress Controller does not use a HTTPRequestRedirectFilter to configure the redirect. Using the filter to redirect HTTP to HTTPS requires a separate HTTPRoute to handle redirected HTTPS traffic, which doesn’t align well with Kong Gateway’s single Route redirect model.

Work to support the standard filter-based configuration is ongoing. Until then, the annotations allow you to configure HTTPS-only HTTPRoutes.

With the redirect configuration in place, HTTP requests now receive a redirect rather than being proxied upstream:

1. Send an HTTP request:

    curl -ksvo /dev/null http://example.com/echo --resolve example.com:80:$PROXY_IP 2>&1 | grep -i http
   

   The results should look like this:

    > GET /echo HTTP/1.1
    < HTTP/1.1 301 Moved Permanently
    < Location: https://example.com/echo
   

2. Send a curl request to follow redirects using the -L flag. This navigates to the HTTPS URL and receives a proxied response from the upstream.

    curl -Lksv http://example.com/echo --resolve example.com:80:$PROXY_IP --resolve example.com:443:$PROXY_IP 2>&1
   

   The results should look like this (some output removed for brevity):

    > GET /echo HTTP/1.1
    > Host: example.com
    >
    < HTTP/1.1 301 Moved Permanently
    < Location: https://example.com/echo
    < Server: kong/3.4.2
       
    * Issue another request to this URL: 'https://example.com/echo'
   
    * Server certificate:
    *  subject: CN=example.com
        
    > GET /echo HTTP/2
    > Host: example.com
    >
    < HTTP/2 200
    < via: kong/3.4.2
    <
    Welcome, you are connected to node kind-control-plane.
    Running on Pod echo-74d47cc5d9-pq2mw.
    In namespace default.
    With IP address 10.244.0.7.
   

Kong Gateway correctly serves the request only on the HTTPS protocol and redirects the user if the HTTP protocol is used. The -k flag in cURL skips certificate validation as the certificate is served by Kong Gateway is a self-signed one. If you are serving this traffic through a domain that you control and have configured TLS properties for it, then the flag won’t be necessary.