<p>I have a functional Ingress running with TLS setup and working correctly. I can access <a href="http://whoami.domain.com" rel="nofollow noreferrer">http://whoami.domain.com</a> and <a href="https://whoami.domain.com" rel="nofollow noreferrer">https://whoami.domain.com</a>, and correct certificate is used on the https domain.</p>

<p>I'm running on Google, and I know that Googles Ingress controller does not allow setting force ssl to assure that the traffic goes over https. I know I can disable http with <strong>kubernetes.io/ingress.allow-http: "false"</strong> but we do not want the friction for the user to know that they need to use https://</p>

<p>My thought of how to solve this would be to have a "redirect" backend that I define as default backend for all port=80 requests, that just 301 to https... However, I cannot find a way to define ingress rules that respects the incoming port.</p>

<p>This is my current thought of how to do it, but of course it does not function :)</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: app-ingress
spec:
  tls:
  - hosts:
    - whoami.domain.com
    secretName: tls-whoami
  rules:
  - host: whoami.domain.com
    port: 443  # my wish :)
    http:
      paths:
      - backend:
          serviceName: whoami-service
          servicePort: 80
  - host: whoami.domain.com
    port: 80  # my wish :)
    http:
      paths:
      - backend:
          serviceName: http-redirect-service
          servicePort: 80
</code></pre>

<p>I have been trying to find WHAT rule keys one can supply, but cannot find any list, just examples where they are all about host and path.</p>

<p>It is currently not possible to set up redirection from <code>http://</code> to <code>https://</code> in Google Cloud Load Balancers. Therefore you cannot do this in GKE Ingress. <a href="https://issuetracker.google.com/35904733" rel="nofollow noreferrer">https://issuetracker.google.com/35904733</a></p>

<p>I personally recommend running a simple service like an nginx container that just rewrites the <code>http://</code> requests to <code>https://</code> and putting it behind the port 80 version of your app.</p>

<p><strong>EDIT:</strong> I'm not sure how to achieve this. You may need two separate Ingress objects with the same hostname, but one with <code>tls:</code> and one without. BUT I'm still not sure if it will work, because the Ingress controller can create multiple forwarding-rules and likely you won't be able to achieve this.</p>

<p>The best solution here might be just using a TCP/IP Load Balancer (Service type:LoadBalancer) listening on both :80 and :443 and terminating TLS yourself.</p>

<p>Check out this question, it's very similar to yours: <a href="https://stackoverflow.com/questions/49667738/implementing-workaround-for-missing-http-https-redirection-in-ingress-gce-with?rq=1">Implementing workaround for missing http-&gt;https redirection in ingress-gce with GLBC</a></p>
