<p>NIFI was deployed in the EKS cluster. The article in this Link(<a href="https://jmrobles.medium.com/running-apache-nifi-on-kubernetes-5b7e95adebf3" rel="nofollow noreferrer">https://jmrobles.medium.com/running-apache-nifi-on-kubernetes-5b7e95adebf3</a>) was followed to deploy the application.  I was able to bring up the application and login successfully. But when I perform certain operations on the UI, the back-end API calls fail with a mixed content error. I am using SSL termination at the ELB (classic) load balancer, so all traffic to the ingress and the pods are with port 80.  Following are some screenshots of the UI and the console.</p>
<p><a href="https://i.stack.imgur.com/5Zhgg.png" rel="nofollow noreferrer">NIFI app loading and I am able to login</a>
<a href="https://i.stack.imgur.com/1b8Cj.png" rel="nofollow noreferrer">NIFI API calls are failing with mixed content error.</a></p>
<p>Following are the deployment, Ingress, and service yaml manifests files:</p>
<pre><code>Deployment Yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nifi
  namespace: default
spec:
  selector:
    matchLabels:
      app: nifi
  template:
    metadata:
      labels:
        app: nifi
    spec:
      containers:
      - name: nifi
        image: apache/nifi:1.14.0
        resources:
          limits:
            memory: &quot;1Gi&quot;
            cpu: &quot;500m&quot;
        ports:
        - containerPort: 8443
        env:
          - name: SINGLE_USER_CREDENTIALS_USERNAME
            value: &quot;admin&quot;
          - name: SINGLE_USER_CREDENTIALS_PASSWORD
            value: “XXXXX”


Service Yaml:
apiVersion: v1
kind: Service
metadata:
  name: nifi-svc
  namespace: default
spec:
  selector:
    app: nifi
  ports:
  - port: 8443
    targetPort: 8443



Ingress Yaml:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nifi-ingress-resource
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;    
    nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
    nginx.ingress.kubernetes.io/upstream-vhost: &quot;localhost:8443&quot;
    nginx.ingress.kubernetes.io/proxy-redirect-from: &quot;https://localhost:8443&quot;
    nginx.ingress.kubernetes.io/proxy-redirect-to: &quot;https://nifi.example.com&quot;
spec:
  ingressClassName: nginx
  rules:
  - host: nifi.example.com
    http:
      paths:
      - path: &quot;/&quot;
        pathType: Prefix
        backend:
          service:
            name: nifi-svc
            port:
              number: 8443


</code></pre>
<p>I am not sure if this can be solved with NIFI properties or with Kubenretes ingress settings. I would like the NIFI application to make API calls with https so that there are no mixed content errors and the API calls are successful.</p>

RVP
<p>I spent half a day budding with AWS Load Balancer and NiFi and was finally able to get this to work with base Nifi Docker image an AWS Load Balancer Controller and an <code>alb</code> Ingress service. I used a single instance NiFi (no ZK clustering). Three key points in the solution are:</p>
<ul>
<li>routing a hostname to AWS Application Load Balancer</li>
<li>configuring web proxy host in NiFi to avoid <code>The request contained an invalid host header</code> error</li>
<li>getting a certificate (I used a private AWS cert for faster setup)</li>
</ul>
<p>Solution:</p>
<p><strong>nifi-deployment.yml</strong> looks like this:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-nifi-deployment
  namespace: nifi
  labels:
    app: my-nifi
    type: nifi
spec:
  replicas: 1
  selector:
    matchLabels:
      app: my-nifi
  template:
    metadata:
      labels:
        app: my-nifi
    spec:
      containers:
        - name: my-nifi
          image: apache/nifi:latest
          env:
            - name: NIFI_WEB_PROXY_HOST
              value: &quot;${ENTER YOUR DOMAIN NAME HERE}&quot;
            - name: NIFI_WEB_HTTPS_PORT
              value: &quot;8443&quot;
</code></pre>
<p><strong>nodeport-service.yml</strong> looks like:</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: my-nifi-nodeport
  namespace: nifi
  labels:
    app: my-nifi
spec:
  type: NodePort
  ports:
    - port: 8443
      targetPort: 8443
      nodePort: 30443
      protocol: TCP
      name: https
  selector:
    app: my-nifi
</code></pre>
<p><strong>ingress-service.yml</strong> looks like:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-nifi-ingress
  namespace: nifi
  labels:
    app: my-nifi
  annotations:
    alb.ingress.kubernetes.io/backend-protocol: HTTPS
    alb.ingress.kubernetes.io/certificate-arn: ${enter your cert ARN here}
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-group-attributes: stickiness.enabled=true,stickiness.lb_cookie.duration_seconds=60
    alb.ingress.kubernetes.io/target-type: instance
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: my-nifi-nodeport
                port:
                  number: 8443
</code></pre>
