<p>I have defined in rancher an external service and an ingress rule that allows me to access my service using: <a href="http://test.mycluster.ml" rel="nofollow noreferrer">http://test.mycluster.ml</a></p>

<p>What I should change to make <a href="https://test.mycluster.ml" rel="nofollow noreferrer">https://test.mycluster.ml</a> instead of http?</p>

<p>Now I have this:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: test
  namespace: default
spec:
  externalName: main.mycluster.ml
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  sessionAffinity: None
  type: ExternalName
</code></pre>

<p>and an ingress rule like this:</p>

<pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-vhost: main.mycluster.ml
    name: test
    namespace: default
  spec:
    rules:
    - host: test.mycluster.ml
      http:
        paths:
        - backend:
            serviceName: test
            servicePort: 80
</code></pre>

<p>How to do it?</p>

<p>I have tried changing the service to be on port 443 and target 80 and the ingress to be on 443 but no success</p>

<pre><code> apiVersion: v1
    kind: Service
    metadata:
      name: test
      namespace: default
    spec:
      externalName: main.mycluster.ml
      ports:
      - port: 443
        protocol: TCP
        targetPort: 80
      sessionAffinity: None
      type: ExternalName
</code></pre>

<p>and an ingress rule like this:</p>

<pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-vhost: main.mycluster.ml
    name: test
    namespace: default
  spec:
    rules:
    - host: test.mycluster.ml
      http:
        paths:
        - backend:
            serviceName: test
            servicePort: 443
</code></pre>

bogdanbrudiu
<p>This looks like bad practice (tls termination for incoming requests while outgoing requests are still in plain http). Please take a look at usage of service type: ExternlName - in the links below- for comunicating internal services with external services) however:</p>
<ul>
<li>Assuming you are using <strong>nginx-ingress</strong> controller <a href="https://kubernetes.github.io/ingress-nginx/deploy/" rel="nofollow noreferrer">maintained by
kubernetes community</a>.</li>
<li>For service <a href="https://kubernetes.io/docs/concepts/services-networking/service/#externalname" rel="nofollow noreferrer"><strong>type: ExternalName</strong></a>
the cluster DNS Service returns a <strong>CNAME</strong> record with the value of
value specified in <strong>spec.externalName</strong>. In your example specified ports <strong>will not take</strong> an effect:</li>
</ul>
<hr />
<pre><code>spec:
  externalName: main.mycluster.ml
  ports:
  - port: 443
    protocol: TCP
    targetPort: 80
</code></pre>
<ul>
<li>Example using service type: externalName. Please take a look at <strong>spec.tls part</strong>:</li>
</ul>
<hr />
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: example
spec:
  type: ExternalName
  externalName: example.com
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: example
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    nginx.ingress.kubernetes.io/upstream-vhost: example.com    # add custom your upstream host
spec:
  rules:
  - host: xxx.xx
    http:
      paths:
      - backend:
          serviceName: example
          servicePort: 80
        path: /
  tls:                    # missing tls part
  - hosts:                 
    - xxx.xx
    secretName: api-cert  
</code></pre>
<p>In this example by default the controller redirects to HTTPS <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-side-https-enforcement-through-redirect" rel="nofollow noreferrer">if TLS is enabled for that ingress</a></p>
<p>In default controller configuration this parameter looks like: <code>nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;</code></p>
<h2>Additional information:</h2>
<ul>
<li>Create <a href="https://kubernetes.github.io/ingress-nginx/user-guide/tls/#tls-secrets" rel="nofollow noreferrer">tls key and cert</a></li>
</ul>
<hr />
<pre><code>openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ${KEY_FILE} -out ${CERT_FILE} -subj &quot;/CN=${HOST}/O=${HOST}&quot;
</code></pre>
<ul>
<li>Create kubernetes <strong>tls secret</strong></li>
</ul>
<hr />
<pre><code>kubectl create secret tls api-cert --key ${KEY_FILE} --cert ${CERT_FILE}
</code></pre>
<ul>
<li>Configure ingress resource with <strong>spec.tls</strong> section (host and tls secret)</li>
</ul>
<blockquote>
<p>Please keep in mind that using kubernetes service <strong>type: ExternalName</strong> with <strong>ingress servicePort: 443</strong> will try to reach your external domain with 443 port and (if the external service is listening on 80 port this solution will not work).</p>
</blockquote>
<p>As workaround you can use <a href="https://kubernetes.io/docs/concepts/services-networking/service/#services-without-selectors" rel="nofollow noreferrer"><em>Service without selector:</em></a></p>
<hr />
<pre><code>kind: Service
apiVersion: v1
metadata:
 name: example2
spec:
 ports:
 - port: 443
   targetPort: 80
---
kind: Endpoints
apiVersion: v1
metadata:
 name: example2
subsets:
 - addresses:
     - ip: 93.184.216.34
   ports:
     - port: 80
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: example
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    nginx.ingress.kubernetes.io/upstream-vhost: example.com    # add custom your upstream host
spec:
  rules:
  - host: xxx.xx
    http:
      paths:
      - backend:
          serviceName: example2
          servicePort: 443
        path: /
  tls:
  - hosts:
    - xxx.xx
    secretName: api-cert
</code></pre>
<p>Use <code>kubectl describe ingress &lt;your_ingress&gt;</code> take a look at he outgoing backend_service with applied port.</p>
<pre><code>Rules:
  Host             Path  Backends
  ----             ----  --------
  xxx.xx  
                   /   example2:443 (93.184.216.34:80)
</code></pre>
<p>Hope this help</p>
