title: Implementing workaround for missing http->https redirection in ingress-gce with GLBC
body: <p>I am trying to wrap my brain around the suggested workarounds for the lack of built-in HTTP->HTTPS redirection in ingress-gce, using GLBC. What I am struggling with is how to use this custom backend that is suggested as one option to overcome this limitation (e.g. in <a href="https://stackoverflow.com/q/37001557/2745865">How to force SSL for Kubernetes Ingress on GKE</a>).</p>
  
  <p>In my case the application behind the load-balancer does not itself have apache or nginx, and I just can't figure out how to include e.g. apache (which I know way better than nginx) in the setup. Am I supposed to set apache in front of the application as a proxy? In that case I wonder what to put in the proxy config as one can't use those convenient k8s service names there...</p>
  
  <p>Or should apache be set up as some kind of a separate backend, which would only get traffic when the client uses plain HTTP? In that case I am missing the separation of backends by protocol in the GCE load-balancer, and while I can see how that could be done manually, the ingress needs to be configured for that, and I can't seem to find any resources explaining how to actually do that.</p>
  
  <p>For example, in <a href="https://github.com/kubernetes/ingress-gce#redirecting-http-to-https" rel="nofollow noreferrer">https://github.com/kubernetes/ingress-gce#redirecting-http-to-https</a> the "application" takes care of the forwaring (it seems to be built on nginx), and while that example works beautifully, it's not possible to do the same thing with the application I am talking about.</p>
  
  <p>Basically, my setup is currently this:</p>
  
  <pre><code>http://&lt;public ip&gt;:80    -\
                             &gt;      GCE LB     -&gt;  K8s pod running the application
  https://&lt;public_ip&gt;:443  -/   (ingress-gce)
  </code></pre>
  
  <p>I know I could block HTTP altogether, but that'd ruin user experience when someone just typed in the domain name in the browser.</p>
  
  <p>Currently I have these services set up for the LB:</p>
  
  <pre><code>kind: Service
  apiVersion: v1
  metadata:
    name: myapp
  spec:
    type: LoadBalancer
    ports:
    - name: http
      port: 80
      targetPort: myapp
      protocol: TCP
    selector:
      app: myapp
  
  ---
  kind: Ingress
  apiVersion: extensions/v1beta1
  metadata:
    name: myapp-ingress
    annotations:
      ingress.kubernetes.io/rewrite-target: /
      kubernetes.io/ingress.global-static-ip-name: "my-ip"
      ingress.gcp.kubernetes.io/pre-shared-cert: "my-cert"
  spec:
    backend:
      serviceName: myapp
      servicePort: 80
    rules:
    - host: my.domain.name
      http:
        paths:
        - path: /
          backend:
            serviceName: myapp
            servicePort: 80
  </code></pre>
  
  <p>In addition I have GLBC bundled together with the application deployment:</p>
  
  <pre><code>apiVersion: v1
  kind: ConfigMap
  metadata:
    name: glbc-configmap
  data:
    gce.conf: |
      [global]
      node-tags = myapp-k8s-nodepool
      node-instance-prefix = gke-myapp-k8s-cluster
  
  ---
  kind: Deployment
  apiVersion: apps/v1beta2
  metadata:
    name: myapp
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: myapp
    template:
      metadata:
        name: myapp
        labels:
          app: myapp
      spec:
        containers:
        # START application container
        - name: myapp
          image: eu.gcr.io/myproject/myapp:latest
          imagePullPolicy: Always
          readinessProbe:
            httpGet:
              path: /ping
              port: 8080
          ports:
          - name: myapp
            containerPort: 8080
        # END application container
        # START GLBC container
        - name: myapp-glbc
          image: gcr.io/google_containers/glbc:0.9.7
          livenessProbe:
            httpGet:
              path: /ping
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 30
            timeoutSeconds: 5
          volumeMounts:
          - mountPath: /etc/glbc-configmap
            name: cloudconfig
            readOnly: true
          args:
          - --apiserver-host=http://localhost:8080
          - --default-backend-service=myapp
          - --sync-period=300s
          - --config-file-path=/etc/glbc-configmap/gce.conf
  </code></pre>
  
  <p>I'd greatly appreciate any pointers in addition to more complete solutions.</p>