tailscale / tailscale/tailscale

FR: Kubernetes operator: Allow HTTPS traffic in Ingress backend to non-443 port

Open
#17,318 0 comments 0 reactions 0 assignees View on GitHub
fr needs-triage
Dominant language
Go
Stars
36.5k
Forks
3.2k
Avg merge
2d 3h
Merged PRs (30d)
123

Description

### What are you trying to do?

I'm trying to expose a Service via Ingress using the Kubernetes Operator, and that Service is exposing the webapplication via HTTPS, but it's using a non-standard `443` port (and non-standard name `https-gui`). When you want to expose an HTTPS backend, then it [needs to be either port `443`, or named `https`](https://tailscale.com/kb/1439/kubernetes-operator-cluster-ingress#exposing-cluster-workloads-using-a-kubernetes-ingress), and that's here not the case, so it will default to HTTP backend traffic.

### How should we solve this?

Allow to configure the backend to be HTTPS without relying on the hard-coded port number `443`, and port name `https`. I'm not sure what the best approach is here, as you potentially can have multiple backends configured on the same Ingress, so a simple annotation might not solve this.

Maybe, an annotation to set on the Ingress that defines all the port names/numbers that should be considered HTTPS is an option?

```yaml
...
annotations:
tailscale.com/https: 443,8443,https,https-gui
...
```

### What is the impact of not solving this?

As a consequence of this, I'm exposing the application now via a Service, and that just exposes the self-signed cert of the HTTPS application, so this requires you to accept the self-signed cert, instead of the LE cert when you use an Ingress. So, not a big impact, but it's now a limitation in the Ingress configuration.

### Anything else?

For some background, the application that I'm exposing here, is the Ubiquiti Unifi application, using the [mkilchhofer unifi-chart](https://github.com/mkilchhofer/unifi-chart) where the Ingress I was trying out is the following:

```yaml
ingress:
enabled: true
ingressClassName: tailscale
path: /
hosts:
- unifi
tls:
- hosts:
- unifi
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.