{"action":"created","issue":{"url":"https://api.github.com/repos/giantswarm/k8scloudconfig/issues/353","repository_url":"https://api.github.com/repos/giantswarm/k8scloudconfig","labels_url":"https://api.github.com/repos/giantswarm/k8scloudconfig/issues/353/labels{/name}","comments_url":"https://api.github.com/repos/giantswarm/k8scloudconfig/issues/353/comments","events_url":"https://api.github.com/repos/giantswarm/k8scloudconfig/issues/353/events","html_url":"https://github.com/giantswarm/k8scloudconfig/pull/353","id":315835525,"number":353,"title":"v_3_2_5: Disable SSL passthrough in nginx-ingress-controller","user":{"login":"r7vme","id":1277504,"avatar_url":"https://avatars1.githubusercontent.com/u/1277504?v=4","gravatar_id":"","url":"https://api.github.com/users/r7vme","html_url":"https://github.com/r7vme","followers_url":"https://api.github.com/users/r7vme/followers","following_url":"https://api.github.com/users/r7vme/following{/other_user}","gists_url":"https://api.github.com/users/r7vme/gists{/gist_id}","starred_url":"https://api.github.com/users/r7vme/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/r7vme/subscriptions","organizations_url":"https://api.github.com/users/r7vme/orgs","repos_url":"https://api.github.com/users/r7vme/repos","events_url":"https://api.github.com/users/r7vme/events{/privacy}","received_events_url":"https://api.github.com/users/r7vme/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-04-19T11:25:00Z","updated_at":"2018-04-19T15:53:59Z","closed_at":null,"author_association":"OWNER","pull_request":{"url":"https://api.github.com/repos/giantswarm/k8scloudconfig/pulls/353","html_url":"https://github.com/giantswarm/k8scloudconfig/pull/353","diff_url":"https://github.com/giantswarm/k8scloudconfig/pull/353.diff","patch_url":"https://github.com/giantswarm/k8scloudconfig/pull/353.patch"},"body":"This change disables unnecessary built-in SSL proxying.\r\n\r\nTested in `gauss`. SSL passthru still works fine.\r\n\r\nWith this change we still can use SSL passthru, because we have AWS ELB proxy protocol enabled. In case, of KVM/Azure we also need to have proxy protocol enabled in external load balancer. Enabling this flag in nginx-ingress-controller only makes sense if no external load balancer if used.\r\n\r\nSee my comment for details: https://github.com/kubernetes/ingress-nginx/issues/2354#issuecomment-382757307\r\n\r\nFixes: https://github.com/giantswarm/giantswarm/issues/2948"},"comment":{"url":"https://api.github.com/repos/giantswarm/k8scloudconfig/issues/comments/382787669","html_url":"https://github.com/giantswarm/k8scloudconfig/pull/353#issuecomment-382787669","issue_url":"https://api.github.com/repos/giantswarm/k8scloudconfig/issues/353","id":382787669,"user":{"login":"r7vme","id":1277504,"avatar_url":"https://avatars1.githubusercontent.com/u/1277504?v=4","gravatar_id":"","url":"https://api.github.com/users/r7vme","html_url":"https://github.com/r7vme","followers_url":"https://api.github.com/users/r7vme/followers","following_url":"https://api.github.com/users/r7vme/following{/other_user}","gists_url":"https://api.github.com/users/r7vme/gists{/gist_id}","starred_url":"https://api.github.com/users/r7vme/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/r7vme/subscriptions","organizations_url":"https://api.github.com/users/r7vme/orgs","repos_url":"https://api.github.com/users/r7vme/repos","events_url":"https://api.github.com/users/r7vme/events{/privacy}","received_events_url":"https://api.github.com/users/r7vme/received_events","type":"User","site_admin":false},"created_at":"2018-04-19T15:53:58Z","updated_at":"2018-04-19T15:53:58Z","author_association":"OWNER","body":"@calvix i've tested that we still can use ssl pass through in `gauss` and can show you how it works. See my comment for details https://github.com/kubernetes/ingress-nginx/issues/2354#issuecomment-382757307\r\n\r\n> If you forward this to simple http endpoint, it will fail.\r\n\r\nYou're right, that's why we still need `nginx.ingress.kubernetes.io/ssl-passthrough: \"true\"` in ingress manifest. But `--enable-ssl-passthrough` is nothing to do with nginx. Flag name is just confusing. It should have been called smth like `--enable-internal-ssl-proxy`."}}
{"actor":{"display_login":"r7vme"}}