<p>I have a Kubernetes cluster running in AWS, and I am working through upgrading various components.  Internally, we are using NGINX, and it is currently at <code>v1.1.1</code> of the <code>nginx-ingress</code> chart (as served from <a href="https://charts.helm.sh/stable" rel="nofollow noreferrer">old stable</a>), with the following configuration:</p>
<pre><code>controller:
  publishService:
    enabled: &quot;true&quot;
  replicaCount: 3
  service:
    annotations:
      external-dns.alpha.kubernetes.io/hostname: '*.MY.TOP.LEVEL.DOMAIN'
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
      service.beta.kubernetes.io/aws-load-balancer-internal: 0.0.0.0/0
      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: [SNIP]
      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: &quot;443&quot;
    targetPorts:
      http: http
      https: http
</code></pre>
<p>My service's ingress resource looks like...</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
  [SNIP]
spec:
  rules:
  - host: MY-SERVICE.MY.TOP.LEVEL.DOMAIN
    http:
      paths:
      - backend:
          serviceName: MY-SERVICE
          servicePort: 80
        path: /
status:
  loadBalancer:
    ingress:
    - hostname: [SNIP]
</code></pre>
<p>This configuration works just fine, however, when I upgrade to <code>v3.11.1</code> of the <code>ingress-nginx</code> chart (as served from <a href="https://kubernetes.github.io/ingress-nginx" rel="nofollow noreferrer">the k8s museum</a>).</p>
<p>With an unmodified config, curling to the HTTPS scheme redirects back to itself:</p>
<pre><code>curl -v https://MY-SERVICE.MY.TOP.LEVEL.DOMAIN/INTERNAL/ROUTE
*   Trying W.X.Y.Z...
* TCP_NODELAY set
* Connected to MY-SERVICE.MY.TOP.LEVEL.DOMAIN (W.X.Y.Z) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=*.MY.TOP.LEVEL.DOMAIN
*  start date: Aug 21 00:00:00 2020 GMT
*  expire date: Sep 20 12:00:00 2021 GMT
*  subjectAltName: host &quot;MY-SERVICE.MY.TOP.LEVEL.DOMAIN&quot; matched cert's &quot;*.MY.TOP.LEVEL.DOMAIN&quot;
*  issuer: C=US; O=Amazon; OU=Server CA 1B; CN=Amazon
*  SSL certificate verify ok.
&gt; GET INTERNAL/ROUTE HTTP/1.1
&gt; Host: MY-SERVICE.MY.TOP.LEVEL.DOMAIN
&gt; User-Agent: curl/7.64.1
&gt; Accept: */*
&gt; 
&lt; HTTP/1.1 308 Permanent Redirect
&lt; Content-Type: text/html
&lt; Date: Wed, 28 Apr 2021 19:07:57 GMT
&lt; Location: https://MY-SERVICE.MY.TOP.LEVEL.DOMAIN/INTERNAL/ROUTE
&lt; Content-Length: 164
&lt; Connection: keep-alive
&lt; 
&lt;html&gt;
&lt;head&gt;&lt;title&gt;308 Permanent Redirect&lt;/title&gt;&lt;/head&gt;
&lt;body&gt;
&lt;center&gt;&lt;h1&gt;308 Permanent Redirect&lt;/h1&gt;&lt;/center&gt;
&lt;hr&gt;&lt;center&gt;nginx&lt;/center&gt;
&lt;/body&gt;
&lt;/html&gt;
* Connection #0 to host MY-SERVICE.MY.TOP.LEVEL.DOMAIN left intact
* Closing connection 0
</code></pre>
<p>(I wish I had captured more verbose output...)</p>
<p>I tried modifying the NGINX config to append the following:</p>
<pre><code>config:
  use-forwarded-headers: &quot;true&quot;
</code></pre>
<p>and then...</p>
<pre><code>config:
  compute-full-forwarded-for: &quot;true&quot;
  use-forwarded-headers: &quot;true&quot;
</code></pre>
<p>These did not seem to make a difference.  It was in the middle of the day, so I wasn't able to dive too far in before rolling back.</p>
<p>What should I look at, and how should I debug this?</p>
<p><strong>Update:</strong></p>
<p>I wish that I had posted a complete copy of the updated config, because I would have noticed that I did <em>not</em> correctly apply the change to add <code>config.compute-full-forwarded-for: &quot;true&quot;</code>.  It need to be within the <code>controller</code> block, and I had placed it elsewhere.</p>
<p>Once the <code>compute-full-forwarded-for: &quot;true&quot;</code> config was added, everything started to work immediately.</p>

object88
<p>This is a community wiki answer posted for better visibility. Feel free to expand it.</p>
<p>As confirmed by @object88 the issue was with misplaced <code>config.compute-full-forwarded-for: &quot;true&quot;</code> configuration which was located in the wrong block. Adding it to the <code>controller</code> block solved the issue.</p>
