{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19497","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19497/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19497/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19497/events","html_url":"https://github.com/kubernetes/kubernetes/issues/19497","id":126022173,"number":19497,"title":"Add basic TLS support to Ingress","user":{"login":"bprashanth","id":10927820,"avatar_url":"https://avatars.githubusercontent.com/u/10927820?v=3","gravatar_id":"","url":"https://api.github.com/users/bprashanth","html_url":"https://github.com/bprashanth","followers_url":"https://api.github.com/users/bprashanth/followers","following_url":"https://api.github.com/users/bprashanth/following{/other_user}","gists_url":"https://api.github.com/users/bprashanth/gists{/gist_id}","starred_url":"https://api.github.com/users/bprashanth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bprashanth/subscriptions","organizations_url":"https://api.github.com/users/bprashanth/orgs","repos_url":"https://api.github.com/users/bprashanth/repos","events_url":"https://api.github.com/users/bprashanth/events{/privacy}","received_events_url":"https://api.github.com/users/bprashanth/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/cluster","name":"team/cluster","color":"d2b48c"}],"state":"open","locked":false,"assignee":{"login":"bprashanth","id":10927820,"avatar_url":"https://avatars.githubusercontent.com/u/10927820?v=3","gravatar_id":"","url":"https://api.github.com/users/bprashanth","html_url":"https://github.com/bprashanth","followers_url":"https://api.github.com/users/bprashanth/followers","following_url":"https://api.github.com/users/bprashanth/following{/other_user}","gists_url":"https://api.github.com/users/bprashanth/gists{/gist_id}","starred_url":"https://api.github.com/users/bprashanth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bprashanth/subscriptions","organizations_url":"https://api.github.com/users/bprashanth/orgs","repos_url":"https://api.github.com/users/bprashanth/repos","events_url":"https://api.github.com/users/bprashanth/events{/privacy}","received_events_url":"https://api.github.com/users/bprashanth/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/15","html_url":"https://github.com/kubernetes/kubernetes/milestones/v1.2","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/15/labels","id":1278499,"number":15,"title":"v1.2","description":"https://github.com/kubernetes/kubernetes/wiki/Release-1.2","creator":{"login":"bgrant0607","id":7725777,"avatar_url":"https://avatars.githubusercontent.com/u/7725777?v=3","gravatar_id":"","url":"https://api.github.com/users/bgrant0607","html_url":"https://github.com/bgrant0607","followers_url":"https://api.github.com/users/bgrant0607/followers","following_url":"https://api.github.com/users/bgrant0607/following{/other_user}","gists_url":"https://api.github.com/users/bgrant0607/gists{/gist_id}","starred_url":"https://api.github.com/users/bgrant0607/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bgrant0607/subscriptions","organizations_url":"https://api.github.com/users/bgrant0607/orgs","repos_url":"https://api.github.com/users/bgrant0607/repos","events_url":"https://api.github.com/users/bgrant0607/events{/privacy}","received_events_url":"https://api.github.com/users/bgrant0607/received_events","type":"User","site_admin":false},"open_issues":68,"closed_issues":31,"state":"open","created_at":"2015-08-29T03:54:16Z","updated_at":"2016-01-12T18:36:38Z","due_on":"2016-01-22T08:00:00Z","closed_at":null},"comments":6,"created_at":"2016-01-11T19:49:16Z","updated_at":"2016-01-12T19:43:52Z","closed_at":null,"body":"Proposal:\r\n```go\r\n$ git diff | tr '+' ' '\r\n\r\ndiff --git a/pkg/api/types.go b/pkg/api/types.go\r\nindex 744a498..de9ed32 100644\r\n--- a/pkg/api/types.go\r\n    b/pkg/api/types.go\r\n@@ -2090,6  2090,14 @@ \r\nconst (\r\n \r\n \t// DockerConfigJsonKey is the key of the required data for SecretTypeDockerConfigJson secrets\r\n \tDockerConfigJsonKey = \".dockerconfigjson\"\r\n \r\n \t// SecretTypeTLS contains information about SSL termination used with the Ingress resource.\r\n \t//\r\n \t// Required fields:\r\n \t// - Secret.Data[\"key\"] - TLS private key in pem format.\r\n \t//   Secret.Data[\"cert\"] - TLS certificate in pem format.\r\n \t// TODO: Consider supporting different formats, destination CA bundle etc.\r\n \tSecretTypeTLS SecretType = \"TLS\"\r\n )\r\n \r\ndiff --git a/pkg/apis/extensions/types.go b/pkg/apis/extensions/types.go\r\nindex f478059..a1e8cc6 100644\r\n--- a/pkg/apis/extensions/types.go\r\n    b/pkg/apis/extensions/types.go\r\n@@ -523,6  523,13 @@ \r\ntype IngressSpec struct {\r\n \t// is optional to allow the loadbalancer controller or defaulting logic to\r\n \t// specify a global default.\r\n \tBackend *IngressBackend `json:\"backend,omitempty\"`\r\n \r\n \t// TLS configuration.\r\n \tTLS []IngressTLS `json:\"tls,omitempty\"`\r\n \r\n \t// A list of host rules used to configure the Ingress. If unspecified, or\r\n \t// no rule matches, all traffic is sent to the default backend.\r\n \tRules []IngressRule `json:\"rules,omitempty\"`\r\n\r\n@@ -535,6  542,21 @@ \r\n // IngressTLS describes the transport layer security associated with an Ingress.\r\n type IngressTLS struct {\r\n \t// If specified, this host is used to multiplex listeners on the same port\r\n \t// via a hostname specified through the SNI TLS extension. The value of this\r\n \t// field must match the name/s used in the tlsSecret.\r\n \tHost string `json:\"host,omitempty\"`\r\n \t// SSL traffic received on this Port must be terminated with the given TLSSecret.\r\n \t// In the future we might support different forms of SSL termination.\r\n \tPort int32 `json:\"port,omitempty\"`\r\n \t// The secret used to terminate SSL traffic on the given port. This field is left\r\n \t// optional to allow SSL routing based on SNI hostname alone. If the SNI host\r\n\t// in the this section conflicts with the \"Host\" header field used by an IngressRule,\r\n\t// the SNI host is used for termination and value of the Host header is used\r\n\t// for routing.\r\n \tTLSSecretRef *api.LocalObjectReference `json:\"tlsSecret,omitempty\"`\r\n \t// TODO: Consider specifying different modes of termination, ssl protocols etc.\r\n }\r\n```\r\n\r\nThis gives us:\r\n```yaml\r\napiVersion: extensions/v1beta1\r\nkind: Ingress\r\nmetadata:\r\n  name: echomap\r\nspec:\r\n  tls:\r\n  - host: foo.bar.com\r\n    port: 443\r\n    tlsSecret:\r\n      name: fooSecret\r\n  - host: bar.baz.com\r\n    port: 443\r\n    tlsSecret:\r\n      name: barSecret\r\n  rules:\r\n  - host: foo.bar.com\r\n    http:\r\n      paths:\r\n      - path: /foo\r\n        backend:\r\n          serviceName: echoheadersx\r\n          servicePort: 80\r\n  - host: bar.baz.com\r\n    http:\r\n      paths:\r\n      - path: /bar\r\n        backend:\r\n          serviceName: echoheadersy\r\n          servicePort: 80\r\n      - path: /foo\r\n        backend:\r\n          serviceName: echoheadersx\r\n          servicePort: 80\r\n```\r\n\r\n@kubernetes/goog-cluster @thockin @smarterclayton "},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/171031000","html_url":"https://github.com/kubernetes/kubernetes/issues/19497#issuecomment-171031000","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/19497","id":171031000,"user":{"login":"pweil-","id":5230419,"avatar_url":"https://avatars.githubusercontent.com/u/5230419?v=3","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"created_at":"2016-01-12T19:43:52Z","updated_at":"2016-01-12T19:43:52Z","body":"> I guess my question is are redirects a frequent enough feature that we should add it to the 60% Ingress or do we banish it to annotations and just handle the most common type of redirect via an insecure field (though redirecting foobar.com to www.foobar.com for seo is pretty common too)\r\n\r\nStarting the insecure options as an annotation is a safe bet.  We can always upgrade it to a field later. "}}