Can SSL offloading be configured when using the Application Gateway Ingress Controller?

I am using the Azure Application Gateway Ingress Controller for Kubernetes. I was able to successfully configure the controller to expose my Kubernetes Services over http. However, I would like the Application Gateway to do SSL offload. So that the Application Gateway will handle https requests, and then forward a plain http request to my Kubernetes service. Currently the Ingress Controller documentation for https requires you to specify the certificate for your Kubernetes Service.

Is it possible to configure the Ingress Controller to do SSL offload so that I don't have to configure https on my Kubernetes Services?

asked Nov 22 '18 at 5:27

ilooner

1,201714

Maybe you are searching for this.

– Charles Xu
Nov 22 '18 at 6:23

That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.

– ilooner
Nov 22 '18 at 6:37

Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.

– Charles Xu
Nov 22 '18 at 8:02

add a comment |

Is it possible to configure the Ingress Controller to do SSL offload so that I don't have to configure https on my Kubernetes Services?

asked Nov 22 '18 at 5:27

ilooner

1,201714

Maybe you are searching for this.

– Charles Xu
Nov 22 '18 at 6:23

That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.

– ilooner
Nov 22 '18 at 6:37

Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.

– Charles Xu
Nov 22 '18 at 8:02

add a comment |

Is it possible to configure the Ingress Controller to do SSL offload so that I don't have to configure https on my Kubernetes Services?

asked Nov 22 '18 at 5:27

ilooner

1,201714

Is it possible to configure the Ingress Controller to do SSL offload so that I don't have to configure https on my Kubernetes Services?

azure kubernetes azure-application-gateway azure-kubernetes

asked Nov 22 '18 at 5:27

ilooner

1,201714

asked Nov 22 '18 at 5:27

ilooner

1,201714

asked Nov 22 '18 at 5:27

ilooner

1,201714

asked Nov 22 '18 at 5:27

ilooner

1,201714

asked Nov 22 '18 at 5:27

ilooner

1,201714

Maybe you are searching for this.

– Charles Xu
Nov 22 '18 at 6:23

That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.

– ilooner
Nov 22 '18 at 6:37

Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.

– Charles Xu
Nov 22 '18 at 8:02

add a comment |

Maybe you are searching for this.

– Charles Xu
Nov 22 '18 at 6:23

That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.

– ilooner
Nov 22 '18 at 6:37

Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.

– Charles Xu
Nov 22 '18 at 8:02

Maybe you are searching for this.

– Charles Xu
Nov 22 '18 at 6:23

That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.

– ilooner
Nov 22 '18 at 6:37

Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.

– Charles Xu
Nov 22 '18 at 8:02

add a comment |

1 Answer
1

active

oldest

votes

I would assume this is the document you are looking for.

  apiVersion: extensions/v1beta1

  kind: Ingress

  metadata:

    name: guestbook

    annotations:

      kubernetes.io/ingress.class: azure/application-gateway

  spec:

    tls:

      - secretName: <guestbook-secret-name>

    rules:

    - http:

        paths:

        - backend:

            serviceName: frontend

            servicePort: 80

ps. no idea why you would use application gateway with k8s. its garbage.

answered Nov 22 '18 at 6:04

4c74356b41

29.5k42154

I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.

– ilooner
Nov 22 '18 at 6:32

why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway

– 4c74356b41
Nov 22 '18 at 7:17

1

Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.

– ilooner
Nov 27 '18 at 0:23

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53424393%2fcan-ssl-offloading-be-configured-when-using-the-application-gateway-ingress-cont%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

I would assume this is the document you are looking for.

  apiVersion: extensions/v1beta1

  kind: Ingress

  metadata:

    name: guestbook

    annotations:

      kubernetes.io/ingress.class: azure/application-gateway

  spec:

    tls:

      - secretName: <guestbook-secret-name>

    rules:

    - http:

        paths:

        - backend:

            serviceName: frontend

            servicePort: 80

ps. no idea why you would use application gateway with k8s. its garbage.

answered Nov 22 '18 at 6:04

4c74356b41

29.5k42154

I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.

– ilooner
Nov 22 '18 at 6:32

why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway

– 4c74356b41
Nov 22 '18 at 7:17

1

Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.

– ilooner
Nov 27 '18 at 0:23

add a comment |

I would assume this is the document you are looking for.

  apiVersion: extensions/v1beta1

  kind: Ingress

  metadata:

    name: guestbook

    annotations:

      kubernetes.io/ingress.class: azure/application-gateway

  spec:

    tls:

      - secretName: <guestbook-secret-name>

    rules:

    - http:

        paths:

        - backend:

            serviceName: frontend

            servicePort: 80

ps. no idea why you would use application gateway with k8s. its garbage.

answered Nov 22 '18 at 6:04

4c74356b41

29.5k42154

I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.

– ilooner
Nov 22 '18 at 6:32

why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway

– 4c74356b41
Nov 22 '18 at 7:17

1

Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.

– ilooner
Nov 27 '18 at 0:23

add a comment |

I would assume this is the document you are looking for.

  apiVersion: extensions/v1beta1

  kind: Ingress

  metadata:

    name: guestbook

    annotations:

      kubernetes.io/ingress.class: azure/application-gateway

  spec:

    tls:

      - secretName: <guestbook-secret-name>

    rules:

    - http:

        paths:

        - backend:

            serviceName: frontend

            servicePort: 80

ps. no idea why you would use application gateway with k8s. its garbage.

answered Nov 22 '18 at 6:04

4c74356b41

29.5k42154

I would assume this is the document you are looking for.

  apiVersion: extensions/v1beta1

  kind: Ingress

  metadata:

    name: guestbook

    annotations:

      kubernetes.io/ingress.class: azure/application-gateway

  spec:

    tls:

      - secretName: <guestbook-secret-name>

    rules:

    - http:

        paths:

        - backend:

            serviceName: frontend

            servicePort: 80

ps. no idea why you would use application gateway with k8s. its garbage.

answered Nov 22 '18 at 6:04

4c74356b41

29.5k42154

answered Nov 22 '18 at 6:04

4c74356b41

29.5k42154

answered Nov 22 '18 at 6:04

4c74356b41

29.5k42154

answered Nov 22 '18 at 6:04

4c74356b41

29.5k42154

I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.

– ilooner
Nov 22 '18 at 6:32

why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway

– 4c74356b41
Nov 22 '18 at 7:17

1

Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.

– ilooner
Nov 27 '18 at 0:23

add a comment |

I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.

– ilooner
Nov 22 '18 at 6:32

why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway

– 4c74356b41
Nov 22 '18 at 7:17

1

Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.

– ilooner
Nov 27 '18 at 0:23

I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.

– ilooner
Nov 22 '18 at 6:32

why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway

– 4c74356b41
Nov 22 '18 at 7:17

Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.

– ilooner
Nov 27 '18 at 0:23

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

Search This Blog

Ufyukyu