{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19333","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19333/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19333/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19333/events","html_url":"https://github.com/kubernetes/kubernetes/issues/19333","id":125208041,"number":19333,"title":"HTTPS Ingress","user":{"login":"paultag","id":132447,"avatar_url":"https://avatars.githubusercontent.com/u/132447?v=3","gravatar_id":"","url":"https://api.github.com/users/paultag","html_url":"https://github.com/paultag","followers_url":"https://api.github.com/users/paultag/followers","following_url":"https://api.github.com/users/paultag/following{/other_user}","gists_url":"https://api.github.com/users/paultag/gists{/gist_id}","starred_url":"https://api.github.com/users/paultag/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paultag/subscriptions","organizations_url":"https://api.github.com/users/paultag/orgs","repos_url":"https://api.github.com/users/paultag/repos","events_url":"https://api.github.com/users/paultag/events{/privacy}","received_events_url":"https://api.github.com/users/paultag/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/cluster","name":"team/cluster","color":"d2b48c"}],"state":"open","locked":false,"assignee":{"login":"bprashanth","id":10927820,"avatar_url":"https://avatars.githubusercontent.com/u/10927820?v=3","gravatar_id":"","url":"https://api.github.com/users/bprashanth","html_url":"https://github.com/bprashanth","followers_url":"https://api.github.com/users/bprashanth/followers","following_url":"https://api.github.com/users/bprashanth/following{/other_user}","gists_url":"https://api.github.com/users/bprashanth/gists{/gist_id}","starred_url":"https://api.github.com/users/bprashanth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bprashanth/subscriptions","organizations_url":"https://api.github.com/users/bprashanth/orgs","repos_url":"https://api.github.com/users/bprashanth/repos","events_url":"https://api.github.com/users/bprashanth/events{/privacy}","received_events_url":"https://api.github.com/users/bprashanth/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2016-01-06T16:12:23Z","updated_at":"2016-01-09T20:20:56Z","closed_at":null,"body":"Happy to send a patch for this -- I've already written an SNI Client Hello packet parser -- \r\n\r\nhttps://github.com/paultag/sniff/blob/master/parser/parser.go\r\n\r\nThat code needs to be audited a bit, and fuzzed, but it's hello-world-ing. Anyone willing to break this?\r\n\r\nHowever, this will fail if the request has no SNI extension, so default routes are unclear to me.\r\n\r\nThe HTTPS Ingress point could do TLS termination, but that'll be mildly annoying for containers that terminate TLS (perhaps Golang apps that to TLS Peer Authentication?), otherwise we could use virtual hosting on HTTP Host. "},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/170278350","html_url":"https://github.com/kubernetes/kubernetes/issues/19333#issuecomment-170278350","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19333","id":170278350,"user":{"login":"bprashanth","id":10927820,"avatar_url":"https://avatars.githubusercontent.com/u/10927820?v=3","gravatar_id":"","url":"https://api.github.com/users/bprashanth","html_url":"https://github.com/bprashanth","followers_url":"https://api.github.com/users/bprashanth/followers","following_url":"https://api.github.com/users/bprashanth/following{/other_user}","gists_url":"https://api.github.com/users/bprashanth/gists{/gist_id}","starred_url":"https://api.github.com/users/bprashanth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bprashanth/subscriptions","organizations_url":"https://api.github.com/users/bprashanth/orgs","repos_url":"https://api.github.com/users/bprashanth/repos","events_url":"https://api.github.com/users/bprashanth/events{/privacy}","received_events_url":"https://api.github.com/users/bprashanth/received_events","type":"User","site_admin":false},"created_at":"2016-01-09T20:20:56Z","updated_at":"2016-01-09T20:20:56Z","body":"Yes, I think we're talking past each other a little :)\r\n\r\nSo it sounds like you're interested in writing an Ingress controller like the ones in [contrib/Ingress](https://github.com/kubernetes/contrib/tree/master/Ingress) that handles (just?)SNI via your go libarary. For example when a user creates an Ingress like:\r\n```yaml\r\napiVersion: extensions/v1beta1\r\nkind: Ingress\r\nmetadata:\r\n  name: test\r\nspec:\r\nrules:\r\n  - host: foo.bar.com\r\n    http:\r\n      paths:\r\n      - path: /*\r\n        backend:\r\n          serviceName: svc1\r\n          servicePort: 80\r\n  - host: bar.baz.com\r\n    http:\r\n      paths:\r\n      - path: /*\r\n        backend:\r\n          serviceName: svc2\r\n          servicePort: 80\r\n```\r\n\r\nYour Ingress controller will start listening on 443 for those 2 hostnames and perform ssl routing to the appropriate service backend (kind of like haproxy does). In the example svc1 and svc2 will terminate ssl. Correct?"}}