Can SSL offloading be configured when using the Application Gateway Ingress Controller?

up vote
0
down vote

favorite

I am using the Azure Application Gateway Ingress Controller for Kubernetes. I was able to successfully configure the controller to expose my Kubernetes Services over http. However, I would like the Application Gateway to do SSL offload. So that the Application Gateway will handle https requests, and then forward a plain http request to my Kubernetes service. Currently the Ingress Controller documentation for https requires you to specify the certificate for your Kubernetes Service.

Is it possible to configure the Ingress Controller to do SSL offload so that I don't have to configure https on my Kubernetes Services?

asked Nov 22 at 5:27

ilooner

1,087614

Maybe you are searching for this.
– Charles Xu
Nov 22 at 6:23

That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.
– ilooner
Nov 22 at 6:37

Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.
– Charles Xu
Nov 22 at 8:02

add a comment |

up vote
0
down vote

favorite

Is it possible to configure the Ingress Controller to do SSL offload so that I don't have to configure https on my Kubernetes Services?

asked Nov 22 at 5:27

ilooner

1,087614

Maybe you are searching for this.
– Charles Xu
Nov 22 at 6:23

That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.
– ilooner
Nov 22 at 6:37

Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.
– Charles Xu
Nov 22 at 8:02

add a comment |

up vote
0
down vote

favorite

Is it possible to configure the Ingress Controller to do SSL offload so that I don't have to configure https on my Kubernetes Services?

asked Nov 22 at 5:27

ilooner

1,087614

Is it possible to configure the Ingress Controller to do SSL offload so that I don't have to configure https on my Kubernetes Services?

azure kubernetes azure-application-gateway azure-kubernetes

asked Nov 22 at 5:27

ilooner

1,087614

asked Nov 22 at 5:27

ilooner

1,087614

asked Nov 22 at 5:27

ilooner

1,087614

asked Nov 22 at 5:27

ilooner

1,087614

asked Nov 22 at 5:27

ilooner

1,087614

Maybe you are searching for this.
– Charles Xu
Nov 22 at 6:23

That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.
– ilooner
Nov 22 at 6:37

Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.
– Charles Xu
Nov 22 at 8:02

add a comment |

Maybe you are searching for this.
– Charles Xu
Nov 22 at 6:23

That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.
– ilooner
Nov 22 at 6:37

Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.
– Charles Xu
Nov 22 at 8:02

Maybe you are searching for this.
– Charles Xu
Nov 22 at 6:23

That looks like a feature request someone proposed for the Application Gateway. So I can't use it to fix my problem.
– ilooner
Nov 22 at 6:37

Application gateway supports SSL termination at the gateway, after which traffic typically flows unencrypted to the backend servers. This feature allows web servers to be unburdened from costly encryption and decryption overhead. This is the feature of Application Gateway. But application gateway supports end to end SSL encryption. See this.
– Charles Xu
Nov 22 at 8:02

add a comment |

1 Answer
1

active

oldest

votes

up vote
2
down vote

accepted

I would assume this is the document you are looking for.

  apiVersion: extensions/v1beta1

  kind: Ingress

  metadata:

    name: guestbook

    annotations:

      kubernetes.io/ingress.class: azure/application-gateway

  spec:

    tls:

      - secretName: <guestbook-secret-name>

    rules:

    - http:

        paths:

        - backend:

            serviceName: frontend

            servicePort: 80

ps. no idea why you would use application gateway with k8s. its garbage.

answered Nov 22 at 6:04

4c74356b41

23.6k32050

I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.
– ilooner
Nov 22 at 6:32

why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway
– 4c74356b41
Nov 22 at 7:17

1

Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.
– ilooner
Nov 27 at 0:23

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53424393%2fcan-ssl-offloading-be-configured-when-using-the-application-gateway-ingress-cont%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
2
down vote

accepted

I would assume this is the document you are looking for.

  apiVersion: extensions/v1beta1

  kind: Ingress

  metadata:

    name: guestbook

    annotations:

      kubernetes.io/ingress.class: azure/application-gateway

  spec:

    tls:

      - secretName: <guestbook-secret-name>

    rules:

    - http:

        paths:

        - backend:

            serviceName: frontend

            servicePort: 80

ps. no idea why you would use application gateway with k8s. its garbage.

answered Nov 22 at 6:04

4c74356b41

23.6k32050

I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.
– ilooner
Nov 22 at 6:32

why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway
– 4c74356b41
Nov 22 at 7:17

1

Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.
– ilooner
Nov 27 at 0:23

add a comment |

up vote
2
down vote

accepted

I would assume this is the document you are looking for.

  apiVersion: extensions/v1beta1

  kind: Ingress

  metadata:

    name: guestbook

    annotations:

      kubernetes.io/ingress.class: azure/application-gateway

  spec:

    tls:

      - secretName: <guestbook-secret-name>

    rules:

    - http:

        paths:

        - backend:

            serviceName: frontend

            servicePort: 80

ps. no idea why you would use application gateway with k8s. its garbage.

answered Nov 22 at 6:04

4c74356b41

23.6k32050

I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.
– ilooner
Nov 22 at 6:32

why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway
– 4c74356b41
Nov 22 at 7:17

1

Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.
– ilooner
Nov 27 at 0:23

add a comment |

up vote
2
down vote

accepted

I would assume this is the document you are looking for.

  apiVersion: extensions/v1beta1

  kind: Ingress

  metadata:

    name: guestbook

    annotations:

      kubernetes.io/ingress.class: azure/application-gateway

  spec:

    tls:

      - secretName: <guestbook-secret-name>

    rules:

    - http:

        paths:

        - backend:

            serviceName: frontend

            servicePort: 80

ps. no idea why you would use application gateway with k8s. its garbage.

answered Nov 22 at 6:04

4c74356b41

23.6k32050

I would assume this is the document you are looking for.

  apiVersion: extensions/v1beta1

  kind: Ingress

  metadata:

    name: guestbook

    annotations:

      kubernetes.io/ingress.class: azure/application-gateway

  spec:

    tls:

      - secretName: <guestbook-secret-name>

    rules:

    - http:

        paths:

        - backend:

            serviceName: frontend

            servicePort: 80

ps. no idea why you would use application gateway with k8s. its garbage.

answered Nov 22 at 6:04

4c74356b41

23.6k32050

answered Nov 22 at 6:04

4c74356b41

23.6k32050

answered Nov 22 at 6:04

4c74356b41

23.6k32050

answered Nov 22 at 6:04

4c74356b41

23.6k32050

I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.
– ilooner
Nov 22 at 6:32

why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway
– 4c74356b41
Nov 22 at 7:17

1

Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.
– ilooner
Nov 27 at 0:23

add a comment |

I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.
– ilooner
Nov 22 at 6:32

why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway
– 4c74356b41
Nov 22 at 7:17

1

Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.
– ilooner
Nov 27 at 0:23

I referenced that document in my question. That configuration requires the Kubernetes service to have the certificate and receive requests over https. This is what I'm trying to avoid. I only want the Application Gateway to receive requests over https, handle SSL for me, and then forward a plain http request to my Kubernetes services.
– ilooner
Nov 22 at 6:32

why do you think that is true? you often see ssl on port 80? or end-to-end ssl on ingress? also, this is not a service, this is an ingress config, so you are wrong on that one. service cannot have ssl, this is the certificate for application gateway
– 4c74356b41
Nov 22 at 7:17

Thanks, you are right I was confusing the concept of a service and ingress, and you were also right that the certificate is for the application gateway. My confusion was partly coming from the fact that we had to save the certificate for the application gateway in kubernetes, which seemed odd to me. But it looks like that was done because the ingress controller needs access to the certificate when it updates the configuration for the Application gateway. Following the instructions you referenced worked for me.
– ilooner
Nov 27 at 0:23

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

Some of your past answers have not been well-received, and you're in danger of being blocked from answering.

Please pay close attention to the following guidance:

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Htykuut