<p>I have some services running on the cluster, and the ALB is working fine. But I have a CloudFront distribution, and I want to use the cluster as an entry point because of some internal factors. So, I am trying to add an ingress to redirect the requests to the CloudFront distribution based on the default rule or a named host, both will work.</p>
<p>I tried 2 different ways, but no dice:</p>
<p>Creating an external name and the ingress:</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: test-ingress
  namespace: default
annotations:
  kubernetes.io/ingress.class: alb
  alb.ingress.kubernetes.io/scheme: &quot;internet-facing&quot;
  alb.ingress.kubernetes.io/listen-ports: '[{&quot;HTTP&quot;:80,&quot;HTTPS&quot;: 443}]'
  alb.ingress.kubernetes.io/certificate-arn: &lt;my-cert-arn&gt;
  alb.ingress.kubernetes.io/actions.ssl-redirect: '{&quot;Type&quot;: &quot;redirect&quot;, &quot;RedirectConfig&quot;: { 
  &quot;Protocol&quot;: &quot;HTTPS&quot;, &quot;Port&quot;: &quot;443&quot;, &quot;StatusCode&quot;: &quot;HTTP_301&quot;}}'
  alb.ingress.kubernetes.io/group.name: &lt;my-group-name&gt;
spec:
  rules:
    - host: test.my-host.net
      HTTP:
        paths:
          - backend:
              serviceName: test
              servicePort: use-annotation
            path: /
---
apiVersion: v1
kind: Service
metadata:
  name: test
spec:
  type: ExternalName
  externalName: test.my-host.net
</code></pre>
<p>I also tried to create the ingress with the redirect with the annotation on the ALB Ingress v2 just like the docs:</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: test-ingress
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: &quot;internet-facing&quot;
    alb.ingress.kubernetes.io/listen-ports: '[{&quot;HTTP&quot;:80,&quot;HTTPS&quot;: 443}]'
    alb.ingress.kubernetes.io/certificate-arn: &lt;my-cert-arn&gt;
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{&quot;Type&quot;: &quot;redirect&quot;, &quot;RedirectConfig&quot;: { 
&quot;Protocol&quot;: &quot;HTTPS&quot;, &quot;Port&quot;: &quot;443&quot;, &quot;StatusCode&quot;: &quot;HTTP_301&quot;}}'
    alb.ingress.kubernetes.io/actions.redirect-to-eks: &gt;
      {&quot;type&quot;:&quot;redirect&quot;,&quot;redirectConfig&quot;:{&quot;host&quot;:&quot;my- 
 dist.cloudfront.net&quot;,&quot;path&quot;:&quot;/&quot;,&quot;port&quot;:&quot;443&quot;,
&quot;protocol&quot;:&quot;HTTPS&quot;,&quot;query&quot;:&quot;k=v&quot;,&quot;statusCode&quot;:&quot;HTTP_302&quot;}}
    alb.ingress.kubernetes.io/group.name: &lt;my-group-name&gt;
spec:
  rules:
    - host: &lt;my-host-name&gt;
      HTTP:
        paths:
          - backend:
              serviceName: ssl-redirect
              servicePort: use-annotation
</code></pre>

<p>The reason why it isn't working with <code>ExternalName</code> service type is because it has no endpoints. ALB can set target only to <code>instance</code> or <code>ip</code> (<a href="https://github.com/HotelsDotCom/alb-ingress-controller/blob/master/docs/ingress-resources.md" rel="noreferrer">documentation</a>) so <code>ExternalName</code> isn't an option here.</p>
<p>You can create redirect with annotation but it is a bit tricky. <strong>First</strong>, you need at least two subnets with public access for <code>alb.ingress.kubernetes.io/subnets</code> annotation. Subnets can be automatically discovered but I don't know if it can pick public ones from all assigned to EKS cluster, so it's better to set explicitly. <strong>Second</strong>, you need to use <code>alb.ingress.kubernetes.io/actions.&lt;ACTION NAME&gt;</code> annotation (<a href="https://github.com/HotelsDotCom/alb-ingress-controller/blob/master/docs/ingress-resources.md" rel="noreferrer">documentation</a>), where <code>&lt;ACTION NAME&gt;</code> must match <code>serviceName</code> from ingress rules. <strong>Third</strong>, you need to specify <code>Host</code> in redirect config or it'll be <code>host</code> from ingress <code>spec</code>.</p>
<p>Here is a working example:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: test-alb
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: &quot;internet-facing&quot;
    alb.ingress.kubernetes.io/subnets: &quot;public-subnet-id1,public-subnet-id2&quot;
    alb.ingress.kubernetes.io/listen-ports: '[{&quot;HTTP&quot;:80,&quot;HTTPS&quot;: 443}]'
    alb.ingress.kubernetes.io/actions.redirect: '{&quot;Type&quot;: &quot;redirect&quot;, &quot;RedirectConfig&quot;: { &quot;Protocol&quot;: &quot;HTTPS&quot;, &quot;Host&quot;:&quot;example.com&quot;, &quot;port&quot;:&quot;443&quot;, &quot;StatusCode&quot;: &quot;HTTP_301&quot;}}'
spec:
  rules:
    - host: alb-test.host.name
      http:
        paths:
          - backend:
              serviceName: redirect
              servicePort: use-annotation
</code></pre>
<p>Your <code>ssl-redirect</code> annotation is almost correct, except that it redirects to <code>&lt;my-host-name&gt;</code>. I recommend you to use the web console (change region in the link) <a href="https://console.aws.amazon.com/ec2/v2/home?region=eu-central-1#LoadBalancers:sort=loadBalancerName" rel="noreferrer">https://console.aws.amazon.com/ec2/v2/home?region=eu-central-1#LoadBalancers:sort=loadBalancerName</a> to see generated redirect rules and debug other options.</p>
<p>There are other options to solve this, a dedicated deployment with <code>nginx</code> for example. Or you can use <a href="https://kubernetes.github.io/ingress-nginx/" rel="noreferrer">nginx ingress controller</a>, from my experience it is much easier to set redirect with it.</p>
