<p>I currently have a working Frontend and Backend nodeports with an Ingress service setup with GKE's Google-managed certificates.</p>
<p>However, my issue is that by default <strong>when a user goes to samplesite.com, it uses http as default.</strong> This means that the user needs to specifically type in the browser <a href="https://samplesite.com" rel="nofollow noreferrer">https://samplesite.com</a> in order to get the https version of my website.</p>
<p><strong>How do I properly disable http on GKE ingress, or how do I redirect all my traffic to https?</strong> I understand that this can be forcefully done in my backend code as well but I want to separate concerns and handle this in my Kubernetes setup.</p>
<p>Here is my ingress.yaml file:</p>
<pre><code>kind: Service
apiVersion: v1
metadata:
  name: frontend-node-service
  namespace: default
spec:
  type: NodePort
  selector:
    app: frontend
  ports:
  - port: 5000
    targetPort: 80
    protocol: TCP
    name: http
---
kind: Service
apiVersion: v1
metadata:
  name: backend-node-service
  namespace: default
spec:
  type: NodePort
  selector:
    app: backend
  ports:
  - port: 8081
    targetPort: 9229
    protocol: TCP
    name: http
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: samplesite-ingress-frontend
  namespace: default
  annotations:
    kubernetes.io/ingress.global-static-ip-name: &quot;samplesite-static-ip&quot;
    kubernetes.io/ingress.allow-http: &quot;false&quot;
    networking.gke.io/managed-certificates: samplesite-ssl
spec:
  backend:
    serviceName: frontend-node-service
    servicePort: 5000
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: samplesite-ingress-backend
  namespace: default
  annotations:
    kubernetes.io/ingress.global-static-ip-name: &quot;samplesite-backend-ip&quot;
    kubernetes.io/ingress.allow-http: &quot;false&quot;
    networking.gke.io/managed-certificates: samplesite-api-ssl
spec:
  backend:
    serviceName: backend-node-service
    servicePort: 8081
</code></pre>

<p><strong>Currently <code>GKE</code> Ingress does not support out of the box <code>HTTP</code>-&gt;<code>HTTPS</code> redirect.</strong></p>
<p>There is an ongoing Feature Request for it here:</p>
<ul>
<li><em><a href="https://issuetracker.google.com/issues/35904733" rel="noreferrer">Issuetracker.google.com: Issues: Redirect all HTTP traffic to HTTPS when using the HTTP(S) Load Balancer
</a></em></li>
</ul>
<p>There are some <strong>workarounds</strong> for it:</p>
<ul>
<li>Use different <code>Ingress</code> controller like <code>nginx-ingress</code>.</li>
<li>Create a <code>HTTP</code>-&gt;<code>HTTPS</code> redirection in <code>GCP</code> Cloud Console.</li>
</ul>
<hr />
<blockquote>
<p>How do I properly disable http on GKE ingress, or how do I redirect all my traffic to https?</p>
</blockquote>
<p>To disable <code>HTTP</code> on <code>GKE</code> you can use following annotation:</p>
<ul>
<li><code>kubernetes.io/ingress.allow-http: &quot;false&quot;</code></li>
</ul>
<p>This annotation will:</p>
<ul>
<li>Allow traffic only on port: <code>443 (HTTPS)</code>.</li>
<li>Deny traffic on port: <code>80 (HTTP)</code> resulting in error code: <code>404</code>.</li>
</ul>
<hr />
<p>Focusing on previously mentioned workarounds:</p>
<h3>Use different <code>Ingress</code> controller like <code>nginx-ingress</code></h3>
<p>One of the ways to have the <code>HTTP</code>-&gt;<code>HTTPS</code> redirection is to use <code>nginx-ingress</code>. You can deploy it with official documentation:</p>
<ul>
<li><em><a href="https://kubernetes.github.io/ingress-nginx/deploy/#gce-gke" rel="noreferrer">Kubernetes.github.io: Ingress-nginx: Deploy: GCE-GKE</a></em></li>
</ul>
<p>This <code>Ingress</code> controller will create a service of type <code>LoadBalancer</code> which will be the entry point for your traffic. <code>Ingress</code> objects will respond on <code>LoadBalancer IP</code>. You can download the manifest from installation part and modify it to support the static IP you have requested in <code>GCP</code>. More reference can be found here:</p>
<ul>
<li><em><a href="https://stackoverflow.com/a/33830507/12257134">Stackoverflow.com: How to specify static IP address for Kubernetes load balancer?</a></em></li>
</ul>
<p>You will need to provide your own certificates or use tools like <code>cert-manager</code> to have <code>HTTPS</code> traffic as the annotation: <code>networking.gke.io/managed-certificates</code> will not work with <code>nginx-ingress</code>.</p>
<p>I used this <code>YAML</code> definition and without any other annotations I was always redirected to the <code>HTTPS</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot; # IMPORTANT
spec:
  tls: # HTTPS PART
  - secretName: ssl-certificate # SELF PROVIDED CERT NAME
  rules:
  - host:
    http:
      paths:
      - path: /
        backend:
          serviceName: hello-service
          servicePort: hello-port
</code></pre>
<hr />
<h3>Create a <code>HTTP</code>-&gt;<code>HTTPS</code> redirection in <code>GCP</code> Cloud Console.</h3>
<p>There is also an option to <strong>manually</strong> create a redirection rule for your <code>Ingress</code> resource. You will need to follow official documentation:</p>
<ul>
<li><em><a href="https://cloud.google.com/load-balancing/docs/https/setting-up-http-https-redirect#setting_up_the_http_load_balancer" rel="noreferrer">Cloud.google.com: Load Balancing: Docs: HTTPS: Setting up HTTP -&gt; HTTPS Redirect</a></em></li>
</ul>
<p>Using the part of above documentation, you will need to create a <code>HTTP</code> LoadBalancer responding on the same IP as your <code>Ingress</code> resource (reserved static IP) redirecting traffic to <code>HTTPS</code>.</p>
<blockquote>
<p>Disclaimer!</p>
<p>Your <code>Ingress</code> resource will need to have following annotation:</p>
<ul>
<li><code>kubernetes.io/ingress.allow-http: &quot;false&quot;</code></li>
</ul>
<p>Lack there of will result in forbidding you to create a redirection mentioned above.</p>
</blockquote>
