tailscale / tailscale/tailscale
FR: Kubernetes operator: Allow HTTPS traffic in Ingress backend to non-443 port
- Dominant language
- Go
- Stars
- 36.5k
- Forks
- 3.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 123
Description
### What are you trying to do?
I'm trying to expose a Service via Ingress using the Kubernetes Operator, and that Service is exposing the webapplication via HTTPS, but it's using a non-standard `443` port (and non-standard name `https-gui`). When you want to expose an HTTPS backend, then it [needs to be either port `443`, or named `https`](https://tailscale.com/kb/1439/kubernetes-operator-cluster-ingress#exposing-cluster-workloads-using-a-kubernetes-ingress), and that's here not the case, so it will default to HTTP backend traffic.
### How should we solve this?
Allow to configure the backend to be HTTPS without relying on the hard-coded port number `443`, and port name `https`. I'm not sure what the best approach is here, as you potentially can have multiple backends configured on the same Ingress, so a simple annotation might not solve this.
Maybe, an annotation to set on the Ingress that defines all the port names/numbers that should be considered HTTPS is an option?
```yaml
...
annotations:
tailscale.com/https: 443,8443,https,https-gui
...
```
### What is the impact of not solving this?
As a consequence of this, I'm exposing the application now via a Service, and that just exposes the self-signed cert of the HTTPS application, so this requires you to accept the self-signed cert, instead of the LE cert when you use an Ingress. So, not a big impact, but it's now a limitation in the Ingress configuration.
### Anything else?
For some background, the application that I'm exposing here, is the Ubiquiti Unifi application, using the [mkilchhofer unifi-chart](https://github.com/mkilchhofer/unifi-chart) where the Ingress I was trying out is the following:
```yaml
ingress:
enabled: true
ingressClassName: tailscale
path: /
hosts:
- unifi
tls:
- hosts:
- unifi
```
Contributor guide
Assessment
This issue has not been assessed yet.