<p>We are running a couple of k8s clusters on Azure AKS.
The service (ghost blog) is behind the Nginx ingress and secured with a cert from Letsencrypt.  All of that works fine but the redirect behavior is what I am having trouble with.</p>
<blockquote>
<p>The Ingress correctly re-directs from <a href="http://whatever.com" rel="nofollow noreferrer">http://whatever.com</a> to
<a href="https://whatever.com" rel="nofollow noreferrer">https://whatever.com</a> — the issue is that it does so using a 308
redirect which strips all post/page Meta anytime a user shares a
page from the site.</p>
</blockquote>
<p>The issue results in users who share any page of the site on most social properties receiving a 'Preview Link' — where the title of the page and the page meta preview do not work and are instead replaced with '308 Permanent Redirect' text — which looks like this:</p>
<p><a href="https://i.stack.imgur.com/DtgR9.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/DtgR9.png" alt="enter image description here" /></a></p>
<p>From the <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-side-https-enforcement-through-redirect" rel="nofollow noreferrer">ingress-nginx docs over here</a> I can see that this is the intended behavior (ie. 308 redirect) what I believe is not intended is the interaction with social sharing services when those services attempt to create a page preview.</p>
<p>While the issue would be solved by Facebook (or twitter, etc etc) pointing direct to the https site by default, I currently have no way to force those sites to look to https for the content that will be used to create the previews.</p>
<h2>Setting Permanent Re-Direct Code</h2>
<p>I can also see that it looks like I should be able to set the redirect code to whatever I want it to be (I believe a 301 redirect will allow Facebook et al. to correctly pull post/page snippet meta), <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#permanent-redirect-code" rel="nofollow noreferrer">docs on that found here</a>.</p>
<p>The problem is that when I add the redirect-code annotation as specified:</p>
<pre><code>nginx.ingress.kubernetes.io/permanent-redirect-code: &quot;301&quot;
</code></pre>
<p>I still get a 308 re-direct on my resources despite being able to see (from my kubectl proxy) that the redirect-code annotation correctly applied. For reference, my full list of annotations on my Ingress looks like this:</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ghost-ingress
  annotations:
    kubernetes.io/tls-acme: &quot;true&quot;
    nginx.ingress.kubernetes.io/permanent-redirect-code: &quot;301&quot;
</code></pre>
<blockquote>
<p>To reiterate — my question is; what is the correct way to force a redirect to https via a custom error code (in my case 301)?</p>
</blockquote>

<p>My guess is the TLS redirect shadows the <code>nginx.ingress.kubernetes.io/permanent-redirect-code</code> annotation. </p>

<p>You can actually change the <code>ConfigMap</code> for your <code>nginx-configuration</code> so that the default redirect is 301. That's the configuration your nginx ingress controller uses for nginx itself. The <code>ConfigMap</code> looks like this:</p>

<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  name: nginx-configuration
  namespace: ingress-nginx
data:
  use-proxy-protocol: "true"
  http-redirect-code: "301"
</code></pre>

<p>You can find more about the <code>ConfigMap</code> options <a href="https://github.com/kubernetes/ingress-nginx/blob/6393ca6aafe73d6f04cd2e1181cdd102e45fe75d/docs/user-guide/nginx-configuration/configmap.md" rel="noreferrer">here</a>. Note that if you change the <code>ConfigMap</code> you'll have to restart your <code>nginx-ingress-controller</code> pod.</p>

<p>You can also shell into the <code>nginx-ingress-controller</code> pod and see the actual nginx  configs that the controller creates:</p>

<pre><code>kubectl -n ingress-nginx exec -it nginx-ingress-controller-xxxxxxxxxx-xxxxx bash
www-data@nginx-ingress-controller-xxxxxxxxx-xxxxx:/etc/nginx$ cat /etc/nginx/nginx.conf
</code></pre>
