{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19497","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19497/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19497/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19497/events","html_url":"https://github.com/kubernetes/kubernetes/issues/19497","id":126022173,"number":19497,"title":"Add basic TLS support to Ingress","user":{"login":"bprashanth","id":10927820,"avatar_url":"https://avatars.githubusercontent.com/u/10927820?v=3","gravatar_id":"","url":"https://api.github.com/users/bprashanth","html_url":"https://github.com/bprashanth","followers_url":"https://api.github.com/users/bprashanth/followers","following_url":"https://api.github.com/users/bprashanth/following{/other_user}","gists_url":"https://api.github.com/users/bprashanth/gists{/gist_id}","starred_url":"https://api.github.com/users/bprashanth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bprashanth/subscriptions","organizations_url":"https://api.github.com/users/bprashanth/orgs","repos_url":"https://api.github.com/users/bprashanth/repos","events_url":"https://api.github.com/users/bprashanth/events{/privacy}","received_events_url":"https://api.github.com/users/bprashanth/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/cluster","name":"team/cluster","color":"d2b48c"}],"state":"open","locked":false,"assignee":{"login":"bprashanth","id":10927820,"avatar_url":"https://avatars.githubusercontent.com/u/10927820?v=3","gravatar_id":"","url":"https://api.github.com/users/bprashanth","html_url":"https://github.com/bprashanth","followers_url":"https://api.github.com/users/bprashanth/followers","following_url":"https://api.github.com/users/bprashanth/following{/other_user}","gists_url":"https://api.github.com/users/bprashanth/gists{/gist_id}","starred_url":"https://api.github.com/users/bprashanth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bprashanth/subscriptions","organizations_url":"https://api.github.com/users/bprashanth/orgs","repos_url":"https://api.github.com/users/bprashanth/repos","events_url":"https://api.github.com/users/bprashanth/events{/privacy}","received_events_url":"https://api.github.com/users/bprashanth/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/15","html_url":"https://github.com/kubernetes/kubernetes/milestones/v1.2","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/15/labels","id":1278499,"number":15,"title":"v1.2","description":"https://github.com/kubernetes/kubernetes/wiki/Release-1.2","creator":{"login":"bgrant0607","id":7725777,"avatar_url":"https://avatars.githubusercontent.com/u/7725777?v=3","gravatar_id":"","url":"https://api.github.com/users/bgrant0607","html_url":"https://github.com/bgrant0607","followers_url":"https://api.github.com/users/bgrant0607/followers","following_url":"https://api.github.com/users/bgrant0607/following{/other_user}","gists_url":"https://api.github.com/users/bgrant0607/gists{/gist_id}","starred_url":"https://api.github.com/users/bgrant0607/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bgrant0607/subscriptions","organizations_url":"https://api.github.com/users/bgrant0607/orgs","repos_url":"https://api.github.com/users/bgrant0607/repos","events_url":"https://api.github.com/users/bgrant0607/events{/privacy}","received_events_url":"https://api.github.com/users/bgrant0607/received_events","type":"User","site_admin":false},"open_issues":79,"closed_issues":33,"state":"open","created_at":"2015-08-29T03:54:16Z","updated_at":"2016-01-17T03:32:35Z","due_on":"2016-01-22T08:00:00Z","closed_at":null},"comments":13,"created_at":"2016-01-11T19:49:16Z","updated_at":"2016-01-19T04:42:29Z","closed_at":null,"body":"Proposal:\r\n```go\r\n$ git diff | tr '+' ' '\r\n\r\ndiff --git a/pkg/api/types.go b/pkg/api/types.go\r\nindex 744a498..de9ed32 100644\r\n--- a/pkg/api/types.go\r\n    b/pkg/api/types.go\r\n@@ -2090,6  2090,14 @@ \r\nconst (\r\n \r\n \t// DockerConfigJsonKey is the key of the required data for SecretTypeDockerConfigJson secrets\r\n \tDockerConfigJsonKey = \".dockerconfigjson\"\r\n \r\n \t// SecretTypeTLS contains information about SSL termination used with the Ingress resource.\r\n \t//\r\n \t// Required fields:\r\n \t// - Secret.Data[\"key\"] - TLS private key in pem format.\r\n \t//   Secret.Data[\"cert\"] - TLS certificate in pem format.\r\n \t// TODO: Consider supporting different formats, destination CA bundle etc.\r\n \tSecretTypeTLS SecretType = \"TLS\"\r\n )\r\n \r\ndiff --git a/pkg/apis/extensions/types.go b/pkg/apis/extensions/types.go\r\nindex f478059..a1e8cc6 100644\r\n--- a/pkg/apis/extensions/types.go\r\n    b/pkg/apis/extensions/types.go\r\n@@ -523,6  523,13 @@ \r\ntype IngressSpec struct {\r\n \t// is optional to allow the loadbalancer controller or defaulting logic to\r\n \t// specify a global default.\r\n \tBackend *IngressBackend `json:\"backend,omitempty\"`\r\n \r\n \t// TLS configuration.\r\n \tTLS []IngressTLS `json:\"tls,omitempty\"`\r\n \r\n \t// A list of host rules used to configure the Ingress. If unspecified, or\r\n \t// no rule matches, all traffic is sent to the default backend.\r\n \tRules []IngressRule `json:\"rules,omitempty\"`\r\n\r\n@@ -535,6  542,21 @@ \r\n // IngressTLS describes the transport layer security associated with an Ingress.\r\n type IngressTLS struct {\r\n \t// If specified, this host is used to multiplex listeners on the same port\r\n \t// via a hostname specified through the SNI TLS extension. The value of this\r\n \t// field must match the name/s used in the tlsSecret.\r\n \tHost string `json:\"host,omitempty\"`\r\n \t// SSL traffic received on this Port must be terminated with the given TLSSecret.\r\n \t// In the future we might support different forms of SSL termination.\r\n \tPort int32 `json:\"port,omitempty\"`\r\n \t// The secret used to terminate SSL traffic on the given port. This field is left\r\n \t// optional to allow SSL routing based on SNI hostname alone. If the SNI host\r\n\t// in the this section conflicts with the \"Host\" header field used by an IngressRule,\r\n\t// the SNI host is used for termination and value of the Host header is used\r\n\t// for routing.\r\n \tTLSSecretRef *api.LocalObjectReference `json:\"tlsSecret,omitempty\"`\r\n \t// TODO: Consider specifying different modes of termination, ssl protocols etc.\r\n }\r\n```\r\n\r\nThis gives us:\r\n```yaml\r\napiVersion: extensions/v1beta1\r\nkind: Ingress\r\nmetadata:\r\n  name: echomap\r\nspec:\r\n  tls:\r\n  - host: foo.bar.com\r\n    port: 443\r\n    tlsSecret:\r\n      name: fooSecret\r\n  - host: bar.baz.com\r\n    port: 443\r\n    tlsSecret:\r\n      name: barSecret\r\n  rules:\r\n  - host: foo.bar.com\r\n    http:\r\n      paths:\r\n      - path: /foo\r\n        backend:\r\n          serviceName: echoheadersx\r\n          servicePort: 80\r\n  - host: bar.baz.com\r\n    http:\r\n      paths:\r\n      - path: /bar\r\n        backend:\r\n          serviceName: echoheadersy\r\n          servicePort: 80\r\n      - path: /foo\r\n        backend:\r\n          serviceName: echoheadersx\r\n          servicePort: 80\r\n```\r\n\r\n@kubernetes/goog-cluster @thockin @smarterclayton "},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/172735286","html_url":"https://github.com/kubernetes/kubernetes/issues/19497#issuecomment-172735286","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19497","id":172735286,"user":{"login":"bprashanth","id":10927820,"avatar_url":"https://avatars.githubusercontent.com/u/10927820?v=3","gravatar_id":"","url":"https://api.github.com/users/bprashanth","html_url":"https://github.com/bprashanth","followers_url":"https://api.github.com/users/bprashanth/followers","following_url":"https://api.github.com/users/bprashanth/following{/other_user}","gists_url":"https://api.github.com/users/bprashanth/gists{/gist_id}","starred_url":"https://api.github.com/users/bprashanth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bprashanth/subscriptions","organizations_url":"https://api.github.com/users/bprashanth/orgs","repos_url":"https://api.github.com/users/bprashanth/repos","events_url":"https://api.github.com/users/bprashanth/events{/privacy}","received_events_url":"https://api.github.com/users/bprashanth/received_events","type":"User","site_admin":false},"created_at":"2016-01-19T04:42:29Z","updated_at":"2016-01-19T04:42:29Z","body":"> Why a Ref and not a Name ?\r\n\r\nName is good enough. I guess we decided the same thing for Backend ->ServiceName too.\r\n\r\n >Doesn't this say that port 80 is using TLS?  I would have expected to see:\r\n\r\n```\r\nlisteners:\r\n- ports:\r\n  - 80 # unencrypted\r\n- ports:\r\n  - 443 # TLS\r\n  hosts:\r\n  - foo.bar.com\r\n  - '*.google.com'\r\n  tlsSecret:\r\n    name: fooSecret\r\n```\r\n\r\nThat's right. That will serve insecurely on :80. Specifying a bunch of ports in the same listener, like so:\r\n```\r\nlisteners:\r\n- ports:\r\n  - 80 \r\n  - 443\r\n  hosts:\r\n  - foo.bar.com\r\n  - '*.google.com'\r\n  tlsSecret:\r\n    name: fooSecret\r\n```\r\nLeaves it to the backend. It could either redirect all ports to the first one, actually write out a redirect rule of the form \"http://foo.com -> https://www.foo.com\", or just serve https on all. \r\n\r\n> So no listeners implies insecure 80?  Where is that documented?\r\n\r\nAs a user I'd expect the Ingress I have today to continue doing what it does, no? Obviously a better choice would be default ssl termination with some cluster cert. "}}