<p>Fast question: how I can debug ingress and Nginx to know where exactly HTTP-&gt;HTTPS redirection happens?</p>
<p>More details:</p>
<p><strong>What we have</strong>: we have war file + Tomcat, build it with Docker. Run it with Kubernetes in AWS.</p>
<p><strong>What we need</strong>: the application should be accessible with HTTP and with HTTPS. HTTP <em><strong>should not</strong></em> redirect to HTTPS.</p>
<p><strong>Problem</strong>: HTTP always redirects to HTTPS.</p>
<p>What we try: we have Ingress</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ${some name
  namespace: ${some namespace}
  labels:
    app: ${some app}
    env: ${some env}
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot; #we added this for turn off https redirection
    nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;false&quot; #we added this for turn off https redirection
    nginx.ingress.kubernetes.io/affinity: &quot;cookie&quot; # We use it for sticky sessions
    nginx.ingress.kubernetes.io/affinity-mode: &quot;persistent&quot;
    nginx.ingress.kubernetes.io/session-cookie-name: &quot;some cookie name&quot;
    nginx.ingress.kubernetes.io/session-cookie-expires: &quot;172800&quot;
    nginx.ingress.kubernetes.io/session-cookie-max-age: &quot;172800&quot;
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/whitelist-source-range: ${whitelist of ip adresses}

spec:
  tls:
    - hosts:
        - ${some host}
        - ${some another host}
      secretName: my-ingress-ssl
  rules:
    - host: ${some host}
      http:
        paths:
          - path: /
            backend:
              serviceName: ${some another service name}
              servicePort: 8080
    - host: ${some another host}
      http:
        paths:
          - path: /
            backend:
              serviceName: ${some another service name}
              servicePort: 8080
</code></pre>
<p>And configmap</p>
<pre><code>kind: ConfigMap
apiVersion: v1
metadata:
  labels:
    app: ${some app}
    env: ${some env}
  namespace: ${some namespace}
  name: nginx-config
data:
  hsts: &quot;false&quot; #we added this for turn off https redirection
  hsts-max-age: &quot;0&quot; #we added this for turn off https redirection
  ssl-redirect: &quot;false&quot; #we added this for turn off https redirection
  hsts-include-subdomains: &quot;false&quot; #we added this for turn off https redirection
</code></pre>
<p>In Tomcat server.xml we have:</p>
<pre><code>&lt;Connector port=&quot;8080&quot; protocol=&quot;HTTP/1.1&quot;
                   connectionTimeout=&quot;20000&quot;
                   redirectPort=&quot;8443&quot; /&gt;
</code></pre>
<p>...</p>
<pre><code>&lt;!-- Define an AJP 1.3 Connector on port 8009 --&gt;
        &lt;Connector port=&quot;8009&quot; protocol=&quot;AJP/1.3&quot; redirectPort=&quot;8443&quot; /&gt;
</code></pre>
<p>...</p>
<p>and this connector we commented (it shouldn't work now):</p>
<pre><code>&lt;!--
&lt;Connector port=&quot;8443&quot; protocol=&quot;org.apache.coyote.http11.Http11AprProtocol&quot;
           maxThreads=&quot;150&quot; SSLEnabled=&quot;true&quot; &gt;
    &lt;UpgradeProtocol className=&quot;org.apache.coyote.http2.Http2Protocol&quot; /&gt;
    &lt;SSLHostConfig&gt;
        &lt;Certificate certificateKeyFile=&quot;conf/key.pem&quot;
                     certificateFile=&quot;conf/cert.pem&quot;
                     certificateChainFile=&quot;conf/chain.pem&quot;
                     type=&quot;RSA&quot; /&gt;
    &lt;/SSLHostConfig&gt;
&lt;/Connector&gt;
--&gt;
</code></pre>
<p>I tried all possible variants with ingress annotations, but without success result.</p>
<p>What I want to know: how can I <em><strong>debug</strong></em> ingress with Nginx to know where exactly HTTP-&gt;HTTPS redirection happens?</p>
<p><strong>UPD</strong></p>
<p>As it turned out, it was not the Nginx controller that was installed on the server, but Traefik. Due to security restrictions, I cant see that pod with the controller. So no Nginx annotations worked.
Nevertheless, the answers below to my questions will help people with a similar problem.</p>

<p>In the setup you describe there are likley to be at least three processes involved in the handling of incoming http requests</p>
<p>internet -&gt; AWS ELB -&gt; Nginx Ingress Controller -&gt; Tomcat</p>
<p>Any of the processes may be able to issue a 301 redirect to instruct http traffic to retry with https. A redirect in the tomcat process could either be specified by tomcat configuration or the app tomcat hosts.</p>
<p>I would attempt to isolate the process that is performing the redirect by experimenting to bypass the higher processes:</p>
<ol>
<li>Bypass the loadbalancer. SSH onto one of the K8s nodes and curl the ingress services' nodeport in the URL (check out Internal Endpoints on the nginx-controller service description for the right port). If you get a redirect, you know the problem is not the the loadbalancer.</li>
<li>Bypass the ingress controllers by 'docker exec' into one of the app containers, then curl localhost:8080. If you get a redirect, you know the problem is not the the ingress controller, and must be in the tomcat config or application.</li>
</ol>
<p>If none of this is possible due to ssh restrictions, curl availability etc... A different approach would be to turn on request logging for each of the processes involved - though this will not be appropriate for a production workload as it will lead to confidential information being output to inappropriate contexts, such as a web tier log file or cloudwatch logs.</p>
