Ambassador: HTTP and HTTPS listeners don't work together

[rafaeloening-barigui]

Describe the bug
I can't use HTTP and HTTPS listeners together without "redirect_cleartext_from".

To Reproduce
Add the below annotation in the ambassador service:

apiVersion: ambassador/v0
kind: Module
name: tls
config:
  server:
    enabled: True

Expected behavior
I want to create HTTP only services and HTTPS only services, but I can't. When I enable the TLS module, the HTTP port in the pods is closed. So, to have both listeners opened, I need to use the "redirect_cleartext_from", so all HTTP request are redirect to HTTPS.

Versions (please complete the following information):

• Ambassador: 0.40.2
• Kubernetes environment: Kubernetes
• Version:
  Client Version: version.Info{Major:"1", Minor:"12", GitVersion:"v1.12.2", GitCommit:"17c77c7898218073f14c8d573582e8d2313dc740", GitTreeState:"clean", BuildDate:"2018-10-24T06:54:59Z", GoVersion:"go1.10.4", Compiler:"gc", Platform:"linux/amd64"}
  Server Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.10", GitCommit:"be1a908c6aa47e0ae1b1dc861a1de6ccfe963aa2", GitTreeState:"clean", BuildDate:"2018-11-13T11:33:04Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}

[nbkrause]

This is something we would like to support. Currently, as a work-around, you can run two deployments of ambassador. One for http and another for https traffic.

[rafaeloening-barigui]

Ok, thanks!

[er1c]

+1 We have some legacy apps that still support non-TLS routes. It would be a pain in the ** to setup the two different ambassador deployments. What I really want to do is simply add a path in the mapping file and setup the ports in the service definition - I don't think that is currently possible? Override on a per-mapping would be a bonus if we wanted to "turn off" defaults.

[vaibhavrtk]

+1 I have a similar requirement where for external traffic I would want to use https along with http redirected to https(redirect_cleartext_from)
and for internal traffic i would want to use only http.
Even when I have 2 ambassador deployments it is not solving it for me as when I put tls module (for using redirect_cleartext_from) It becomes applicable for all ambassador deployments and my internal traffic stops working. Please support tls module per ambassador deployment/service

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[juanjoku]

We have the same problem: we prefer Ambassador to be able to work with http and https, while Envoy allows it.

[richarddli]

Community contributions for this are appreciated!

[albertdb]

Could you please give some priority to this?

[DavidDomkar]

Today I ran into a problem with cert manager listeners because of this. Any updates on the issue?

[eburghar]

cert-manager is not able to connect to http:// if tls is enabled in ambassador. Apparently disabling temporally tls via the module configuration doesn't seem to work as long as there is some tlscontext.

Working with 2 ambassadors instances (one on 80 which have to the acme mapping, and the other one on https which have the app mapping) doesn't help much.

1. You would need some port-forward reflexion on your router to be able to use the external ip from inside the cluster.

2. How do you redirect to https if the path is not the letsencrypt challenge ?

Using cert-manager HTTP01 with ambassador is everything but straightforward with ambassador.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[albertdb]

Bad bot. Don't close.

[Horkyze]

@eburghar you are right, it is pain, however this information may help:

Reading from https://letsencrypt.org/docs/challenge-types/

Our implementation of the HTTP-01 challenge follows redirects, up to 10 redirects deep. It only accepts redirects to “http:” or “https:”, and only to ports 80 or 443. It does not accept redirects to IP addresses. When redirected to an HTTPS URL, it does not validate certificates (since this challenge is intended to bootstrap valid certificates, it may encounter self-signed or expired certificates along the way).

Meaning, the HTTP-01 challenge should work with HTTPS only ambassador. I have not tried it thou.

[jujugrrr]

This is something we would like to support. Currently, as a work-around, you can run two deployments of ambassador. One for http and another for https traffic.

Hi @nbkrause , do you have an update on this?
Thank you

[juanjoku]

Hello,

In issue https://github.com/datawire/ambassador/issues/1335, the proposed solution
is to "create two instances of Ambassador (one for HTTP, one for HTTPS).

But (I think) this is not enough, because redirection is applied in all cases! :-(

Suposse this requirements:

• Serve my application A on https://aaa.mycompany.com:443.
  http://aaa.mycompany.com:80 must not be redirected to https.

• Serve my application B on https://bbb.mycompany.com:443.
  http://bbb.mycompany.com:80 must be redirected to https.

• Serve my application C on http://ccc.mycompany.com:80
  I haven't certificates for this domain.

Envoy allows this configuration.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[albertdb]

Bad bot. Don't close.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.