<p>The <a href="https://help.hcltechsw.com/connections/v65/admin/install/cp_config_om_http_server.html" rel="nofollow noreferrer">Component Pack documentation</a> uses http for the connection from IHS to the Kubernetes backend. This is not up-to-date any more, so I'd like to use https for those backend connection as well as in IHS like this:</p>

<pre><code>User &lt;----- https -----&gt; IHS &lt;----- https -----&gt; K8S Backend
</code></pre>

<p>Following HCLs documentation, we just got</p>

<pre><code>User &lt;----- https -----&gt; IHS &lt;----- http -----&gt; K8S Backend
</code></pre>

<p><a href="https://help.hcltechsw.com/connections/v65/admin/install/cp_installing_ingress_controller.html" rel="nofollow noreferrer">Component Packs ingress</a> doesn't have any configuration options for https documented. </p>

Lion
<p>I unpacked the chart and looked at it's default <code>values.yml</code>. It seems that IBM/HCL doesn't follow the Helm template, which allow configuring https in almost any charts using <code>ingress.tls</code>. </p>

<p>The only possible way seems to be manually modifying our ingress ressources like this:</p>

<ol>
<li><code>kubectl edit ing cnx-ingress-orient-me</code></li>
<li>Replace <code>*</code> by a subdomain (e.g. <code>ing</code>): <code>- host: ing.k8s.internal</code></li>
<li>Add a <code>tls</code> section in <code>spec</code>:</li>
</ol>

<pre><code> tls:
  - hosts:
    - ing.k8s.internal
</code></pre>

<ol start="4">
<li><p>Save the changes and verify your ingress is avaliable using https, for example with the comp</p>

<p><code>curl "https://ing.k8s.internal/social/views/login.html" --head</code> should return <code>HTTP/2 200</code></p></li>
</ol>

<p>We need to repat this for <strong>all</strong> deployed ingress ressources. When all features are deployed, there are 4:</p>

<pre><code>$ kging | grep -v NAME | awk '{print $1}'
cnx-ingress-appreg
cnx-ingress-orient-me
cnx-ingress-sanity
external-service
</code></pre>

<h3>Automation</h3>

<p>Its also possible to automate those changes by exporting the ingress to a file:</p>

<pre><code>kubectl get ing cnx-ingress-orient-me -o yaml &gt; /tmp/ing.yml
</code></pre>

<p>No we can search/replace using <code>sed</code></p>

<pre><code># Replaces the general HTTP listen hostname
sed -i "s/host: '\*\./ing./g" /tmp/ing.yml
# Adds tls-tree with corresponding indention
sed "s/\(\s*\)\(rules:\)/tls:\n\1- hosts:\n\1\1- ing.k8s.internal\n\1\2/g" /tmp/ing.yml
</code></pre>

<p>To apply our changes:</p>

<pre><code>kubectl replace -f /tmp/ing.yml
</code></pre>
