<p>I am very new to Kubernetes and I am trying to figure out how to set up a http -> https redirect for my kubernetes cluster. I have searched and have tried many different annotations and I am not sure if I am applying them correctly or not. I have pasted my files below and would be happy to share more if more is necessary. </p>

<p>I have tried to adding these lines to the annotation section</p>

<pre><code>nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
</code></pre>

<p>I have also tried to implement this workaround, but have not had success.</p>

<p><a href="https://github.com/kubernetes/ingress-nginx/issues/2724#issuecomment-444835897" rel="noreferrer">Redirect workaround</a></p>

<p>I appreciate the help! </p>

<p>service.yaml</p>

<pre><code>kind: Service
apiVersion: v1
metadata:
  name: loadbalancer-ingress
  annotations:
    {{- if .Values.loadbalancer.cert }}
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: {{ .Values.loadbalancer.cert | quote }}
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "{{- range .Values.loadbalancer.ports -}}{{- if .ssl -}}{{ .name }},{{- end -}}{{- end -}}"
    {{- end }}
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: {{ .Values.loadbalancer.backend_protocol | quote }}
    service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60"
spec:
  type: LoadBalancer
  selector: 
    pod: {{ .Chart.Name }}
  ports:
    {{- range .Values.loadbalancer.ports }}
    - name: {{ .name }}
      port: {{ .port }}
      targetPort: {{ .targetPort }}
    {{- end }}
</code></pre>

<p>configmap.yaml</p>

<pre><code>---
kind: ConfigMap
apiVersion: v1
metadata:
  name: {{ .Chart.Name }}-nginx-configuration
data:
  use-proxy-protocol: "false"
  use-forwarded-headers: "true"
  server-tokens: "false"

---
kind: ConfigMap
apiVersion: v1
metadata:
  name: {{ .Chart.Name }}-tcp-services

---
kind: ConfigMap
apiVersion: v1
metadata:
  name: {{ .Chart.Name }}-udp-services
</code></pre>

<p>values.yaml</p>

<pre><code>loadbalancer:
  backend_protocol: http
  cert: MY_AWS_CERT
  ports:
    - name: http
      port: 80
      targetPort: 80
      ssl: false
    - name: https
      port: 443
      targetPort: 80
      ssl: true
</code></pre>

<h1>HTTPS for backend</h1>
<p>If you wanna to setup <code>https</code> as backend traffic, then replace <code>http</code>-&gt;<code>https</code> in <code>values.yaml</code></p>
<h2>Explanation:</h2>
<p><code>service.yaml</code> has:</p>
<pre><code>service.beta.kubernetes.io/aws-load-balancer-backend-protocol: {{ .Values.loadbalancer.backend_protocol | quote }}
</code></pre>
<p>It means that <code>aws-load-balancer-backend-protocol</code> is declared in <code>values.yaml</code></p>
<pre><code>loadbalancer:
  backend_protocol: http
</code></pre>
<p>According to <a href="https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#aws" rel="nofollow noreferrer"><code>AWS</code> part of <code>k8s</code> man</a>:</p>
<blockquote>
<p><code>service.beta.kubernetes.io/aws-load-balancer-backend-protocol</code>: Used on the service to specify the protocol spoken by the backend (pod) behind a listener. If <code>http</code> (default) or <code>https</code>, an HTTPS listener that terminates the connection and parses headers is created. If set to <code>ssl</code> or <code>tcp</code>, a “raw” SSL listener is used. If set to <code>http</code> and <code>aws-load-balancer-ssl-cert</code> is not used then a HTTP listener is used.</p>
</blockquote>
<h1>HTTPS for frontend</h1>
<p>If your question about <code>https</code> for frontend, then setup an <code>ingress</code>-controller.
As per <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer"><code>ingress</code> <code>man</code> of <code>k8s</code></a>:</p>
<blockquote>
<p>You must have an <a href="https://kubernetes.io/docs/concepts/services-networking/ingress-controllers" rel="nofollow noreferrer">ingress controller</a> to satisfy an Ingress. <strong>Only creating an Ingress resource has no effect.</strong></p>
<p>You may need to deploy an Ingress controller such as <a href="https://kubernetes.github.io/ingress-nginx/deploy/" rel="nofollow noreferrer">ingress-nginx</a>.</p>
</blockquote>
<p><a href="https://kubernetes.github.io/ingress-nginx/deploy/#aws" rel="nofollow noreferrer">AWS</a> part of  NGINX <code>ingress</code> controller installation guide <a href="https://kubernetes.github.io/ingress-nginx/deploy/#aws" rel="nofollow noreferrer">is here</a>:</p>
<blockquote>
<p>In AWS we use a Network load balancer (NLB) to expose the NGINX Ingress controller behind a Service of <code>Type=LoadBalancer</code>.</p>
Network Load Balancer (NLB) <a href="https://kubernetes.github.io/ingress-nginx/deploy/#network-load-balancer-nlb" rel="nofollow noreferrer" title="Permanent link">¶</a>
<pre><code>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-0.32.0/deploy/static/provider/aws/deploy.yaml
</code></pre>
<p>`</p>
TLS termination in AWS Load Balancer (ELB) &gt; In some scenarios is required to terminate TLS in the Load Balancer and not in the ingress controller.
<p>For this purpose we provide a template: <a href="https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-0.32.0/deploy/static/provider/aws/deploy-tls-termination.yaml" rel="nofollow noreferrer">deploy-tls-termination.yaml</a></p>
<pre><code>wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-0.32.0/deploy/static/provider/aws/deploy-tls-termination.yaml
</code></pre>
<ul>
<li>Edit the file and change:</li>
<li>VPC CIDR in use for the Kubernetes cluster: <code>proxy-real-ip-cidr: XXX.XXX.XXX/XX</code></li>
<li>AWS Certificate Manager (ACM) ID
<code>arn:aws:acm:us-west-2:XXXXXXXX:certificate/XXXXXX-XXXXXXX-XXXXXXX-XXXXXXXX</code></li>
<li>Deploy the manifest:
<code>kubectl apply -f deploy-tls-termination.yaml</code></li>
</ul>
</blockquote>
