DocsEdge Stack1.14Cleartext support
Cleartext support
While most modern web applications will choose to encrypt all traffic, there are reasons why you will want to support clients who access your website without encryption in cleartext.
Ambassador Edge Stack supports both forcing
automatic redirection to HTTPS and
serving cleartext traffic on a Host
.
Cleartext routing
Ambassador Edge Stack has full support for routing cleartext traffic to upstream services
for a Host
.
Only cleartext
The default for the Open-Source Emissary-ingress is to serve cleartext on port 8080 in the container. See TLS documentation for information on how to configure TLS termination.
For Ambassador Edge Stack, TLS termination is enabled by default with a
self-signed certificate or an ACME Host
. To disable TLS termination in Ambassador Edge Stack, delete any existing Host
s and set the
requestPolicy.insecure.action
to Route
in a Host
:
WARNING - Host Configuration: The
requestPolicy
property of theHost
CRD
is applied globally within an Ambassador Edge Stack instance, even if it is applied to only oneHost
when multipleHost
s are configured. DifferentrequestPolicy
behaviors cannot be applied to differentHost
s. It is recommended to apply an identicalrequestPolicy
to allHost
s instead of assuming the behavior, to create a more human readable config.If a requestPolicy is not defined for a
Host
, it's assumed to beRedirect
, so even if aHost
does not specify it, the defaultrequestPolicy
ofRedirect
will be applied to allHost
s in that Ambassador Edge Stack instance. If the behavior expected out of Ambassador Edge Stack is anything other thanRedirect
, it must be explicitly enumerated in all Host resources.Unexpected behavior can occur when multiple
Host
resources are not using the same value forrequestPolicy
.For more information, please refer to the
Host
documentation.The
insecure-action
can be one of:
Redirect
(the default): redirect to HTTPSRoute
: go ahead and route as normal; this will allow handling HTTP requests normallyReject
: reject the request with a 400 response
HTTPS and cleartext
Ambassador Edge Stack can also support serving both HTTPS and cleartext traffic from a single Ambassador Edge Stack.
This configuration is the same whether you are running the Open-Source Emissary-ingress or the Ambassador Edge Stack. The configuration is very similar to the
Host
above but with the Host
configured to terminate TLS.
With the above configuration, we are tell Ambassador Edge Stack to terminate TLS with the
certificate in the example-cert
Secret
and route cleartext traffic that
comes in over port 8080
.
HTTP->HTTPS redirection
Most modern websites that force HTTPS will also automatically redirect any requests that come into it over HTTP. In Ambassador Edge Stack, this is enabled by default but can easily be enabled in any version of Ambassador Edge Stack.
In Ambassador Edge Stack, this is configured by setting the
insecure.action
in a Host
to Redirect
.
Ambassador Edge Stack will then enable cleartext redrection in two ways.
First, Ambassador Edge Stack will listen on the insecure.additionalPort
and consider any
traffic on this port as insecure
and redirect it to HTTPS.
Additionally, Ambassador Edge Stack will also check the X-Forwarded-Proto
header of
the incoming request on the secure
port (8443
)and issue a 301 redirect if
it is set to HTTP
.
The value of X-Forwarded-Proto
is dependent on whatever is forwarding traffic
to Ambassador Edge Stack. A couple of options are
Layer 4 Load Balancer, Proxy, or direct from the client:
X-Forwarded-Proto
is not set or is untrusted. Envoy will set it based off the protocol of the incoming request.If Envoy determines the request is encrypted, it will be set to
HTTPS
. If not, it will be set toHTTP
.Layer 7 Load Balancer or Proxy:
X-Forwarded-Proto
is set by the load balancer or proxy and trusted by Envoy. Envoy will trust the value ofX-Forwarded-For
even if the request comes in over cleartext.
Summary
Ambassador Edge Stack will enable cleartext redirection by default.
To enable cleartext redirection in any version of Ambassador Edge Stack, simply configure
a Host
to redirect cleartext to HTTPS like below:
ON THIS PAGE