Can SSL offloading be configured when using the Application Gateway Ingress Controller?
0
I am using the Azure Application Gateway Ingress Controller for Kubernetes. I was able to successfully configure the controller to expose my Kubernetes Services over http. However, I would like the Application Gateway to do SSL offload. So that the Application Gateway will handle https requests, and then forward a plain http request to my Kubernetes service. Currently the Ingress Controller documentation for https requires you to specify the certificate for your Kubernetes Service.
Is it possible to configure the Ingress Controller to do SSL offload so that I don't have to configure https on my Kubernetes Services?
azure kubernetes azure-application-gateway azure-kubernetes asked Nov 22 '18 at 5:27
iloonerilooner
1,136714
add a comment |
0
I am using the Azure Application Gateway Ingress Controller for Kubernetes. I was able to successfully configure the controller to expose my Kubernetes Services over http. However, I would like the Application Gateway to do SSL offload. So that the Application Gateway will handle https requests, and then forward a plain http request to my Kubernetes service. Currently the Ingress Controller documentation for https requires you to specify the certificate for your Kubernetes Service.
Is it possible to configure the Ingress Controller to do SSL offload so that I don't have to configure https on my Kubernetes Services?
azure kubernetes azure-application-gateway azure-kubernetes asked Nov 22 '18 at 5:27
iloonerilooner
1,136714
Maybe you are searching for this.
– Charles Xu
Nov 22 '18 at 6:23
That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.
– ilooner
Nov 22 '18 at 6:37
Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.
– Charles Xu
Nov 22 '18 at 8:02
add a comment |
0
0
0
I am using the Azure Application Gateway Ingress Controller for Kubernetes. I was able to successfully configure the controller to expose my Kubernetes Services over http. However, I would like the Application Gateway to do SSL offload. So that the Application Gateway will handle https requests, and then forward a plain http request to my Kubernetes service. Currently the Ingress Controller documentation for https requires you to specify the certificate for your Kubernetes Service.
Is it possible to configure the Ingress Controller to do SSL offload so that I don't have to configure https on my Kubernetes Services?
azure kubernetes azure-application-gateway azure-kubernetes asked Nov 22 '18 at 5:27
iloonerilooner
1,136714
I am using the Azure Application Gateway Ingress Controller for Kubernetes. I was able to successfully configure the controller to expose my Kubernetes Services over http. However, I would like the Application Gateway to do SSL offload. So that the Application Gateway will handle https requests, and then forward a plain http request to my Kubernetes service. Currently the Ingress Controller documentation for https requires you to specify the certificate for your Kubernetes Service.
Is it possible to configure the Ingress Controller to do SSL offload so that I don't have to configure https on my Kubernetes Services?
azure kubernetes azure-application-gateway azure-kubernetes azure kubernetes azure-application-gateway azure-kubernetes asked Nov 22 '18 at 5:27
iloonerilooner
1,136714
asked Nov 22 '18 at 5:27
iloonerilooner
1,136714
asked Nov 22 '18 at 5:27
iloonerilooner
1,136714
asked Nov 22 '18 at 5:27
iloonerilooner
1,136714
asked Nov 22 '18 at 5:27
iloonerilooner
1,136714
1,136714
Maybe you are searching for this.
– Charles Xu
Nov 22 '18 at 6:23
That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.
– ilooner
Nov 22 '18 at 6:37
Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.
– Charles Xu
Nov 22 '18 at 8:02
add a comment |
Maybe you are searching for this.
– Charles Xu
Nov 22 '18 at 6:23
That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.
– ilooner
Nov 22 '18 at 6:37
Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.
– Charles Xu
Nov 22 '18 at 8:02
Maybe you are searching for this.
– Charles Xu
Nov 22 '18 at 6:23
Maybe you are searching for this.
– Charles Xu
Nov 22 '18 at 6:23
That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.
– ilooner
Nov 22 '18 at 6:37
That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.
– ilooner
Nov 22 '18 at 6:37
Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.
– Charles Xu
Nov 22 '18 at 8:02
Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.
– Charles Xu
Nov 22 '18 at 8:02
add a comment |
1 Answer
1
active
oldest
votes
2
I would assume this is the document you are looking for.
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: guestbook
annotations:
kubernetes.io/ingress.class: azure/application-gateway
spec:
tls:
- secretName: <guestbook-secret-name>
rules:
- http:
paths:
- backend:
serviceName: frontend
servicePort: 80
ps. no idea why you would use application gateway with k8s. its garbage.
answered Nov 22 '18 at 6:04
4c74356b414c74356b41
25.3k42051
I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.
– ilooner
Nov 22 '18 at 6:32
why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway
– 4c74356b41
Nov 22 '18 at 7:17
1
Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.
– ilooner
Nov 27 '18 at 0:23
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53424393%2fcan-ssl-offloading-be-configured-when-using-the-application-gateway-ingress-cont%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
2
I would assume this is the document you are looking for.
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: guestbook
annotations:
kubernetes.io/ingress.class: azure/application-gateway
spec:
tls:
- secretName: <guestbook-secret-name>
rules:
- http:
paths:
- backend:
serviceName: frontend
servicePort: 80
ps. no idea why you would use application gateway with k8s. its garbage.
answered Nov 22 '18 at 6:04
4c74356b414c74356b41
25.3k42051
I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.
– ilooner
Nov 22 '18 at 6:32
why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway
– 4c74356b41
Nov 22 '18 at 7:17
1
Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.
– ilooner
Nov 27 '18 at 0:23
add a comment |
2
I would assume this is the document you are looking for.
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: guestbook
annotations:
kubernetes.io/ingress.class: azure/application-gateway
spec:
tls:
- secretName: <guestbook-secret-name>
rules:
- http:
paths:
- backend:
serviceName: frontend
servicePort: 80
ps. no idea why you would use application gateway with k8s. its garbage.
answered Nov 22 '18 at 6:04
4c74356b414c74356b41
25.3k42051
I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.
– ilooner
Nov 22 '18 at 6:32
why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway
– 4c74356b41
Nov 22 '18 at 7:17
1
Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.
– ilooner
Nov 27 '18 at 0:23
add a comment |
2
2
2
I would assume this is the document you are looking for.
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: guestbook
annotations:
kubernetes.io/ingress.class: azure/application-gateway
spec:
tls:
- secretName: <guestbook-secret-name>
rules:
- http:
paths:
- backend:
serviceName: frontend
servicePort: 80
ps. no idea why you would use application gateway with k8s. its garbage.
answered Nov 22 '18 at 6:04
4c74356b414c74356b41
25.3k42051
I would assume this is the document you are looking for.
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: guestbook
annotations:
kubernetes.io/ingress.class: azure/application-gateway
spec:
tls:
- secretName: <guestbook-secret-name>
rules:
- http:
paths:
- backend:
serviceName: frontend
servicePort: 80
ps. no idea why you would use application gateway with k8s. its garbage.
answered Nov 22 '18 at 6:04
4c74356b414c74356b41
25.3k42051
answered Nov 22 '18 at 6:04
4c74356b414c74356b41
25.3k42051
answered Nov 22 '18 at 6:04
4c74356b414c74356b41
25.3k42051
answered Nov 22 '18 at 6:04
4c74356b414c74356b41
25.3k42051
25.3k42051
I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.
– ilooner
Nov 22 '18 at 6:32
why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway
– 4c74356b41
Nov 22 '18 at 7:17
1
Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.
– ilooner
Nov 27 '18 at 0:23
add a comment |
I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.
– ilooner
Nov 22 '18 at 6:32
why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway
– 4c74356b41
Nov 22 '18 at 7:17
1
Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.
– ilooner
Nov 27 '18 at 0:23
I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.
– ilooner
Nov 22 '18 at 6:32
I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.
– ilooner
Nov 22 '18 at 6:32
why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway
– 4c74356b41
Nov 22 '18 at 7:17
why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway
– 4c74356b41
Nov 22 '18 at 7:17
1
1
Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.
– ilooner
Nov 27 '18 at 0:23
Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.
– ilooner
Nov 27 '18 at 0:23
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53424393%2fcan-ssl-offloading-be-configured-when-using-the-application-gateway-ingress-cont%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Maybe you are searching for this.
– Charles Xu
Nov 22 '18 at 6:23
That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.
– ilooner
Nov 22 '18 at 6:37
Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.
– Charles Xu
Nov 22 '18 at 8:02