Cleartext support

While most modern web applications choose to encrypt all traffic, there are reasons why you will want to support clients who access your website without encryption in cleartext.

Ambassador Edge Stack supports both forcing automatic redirection to HTTPS and serving cleartext traffic on a Host.

Cleartext routing

Ambassador Edge Stack has full support for routing cleartext traffic to upstream services for a Host.

Only cleartext

The default for the Open-Source Emissary-ingress is to serve cleartext on port 8080 in the container. See TLS documentation for information on how to configure TLS termination.

For Ambassador Edge Stack, TLS termination is enabled by default with a self-signed certificate or an ACME Host. To disable TLS termination in Ambassador Edge Stack, delete any existing Hosts and set the requestPolicy.insecure.action to Route in a Host:

The insecure-action can be one of:

• Redirect (the default): redirect to HTTPS
• Route: go ahead and route as normal; this will allow handling HTTP requests normally
• Reject: reject the request with a 400 response

HTTPS and cleartext

Ambassador Edge Stack can also support serving both HTTPS and cleartext traffic from a single Ambassador Edge Stack.

This configuration is the same whether you are running the Open-Source Emissary-ingress or the Ambassador Edge Stack. The configuration is very similar to the Host above but with the Host configured to terminate TLS.

With the above configuration, we are tell Ambassador Edge Stack to terminate TLS with the certificate in the example-cert Secret and route cleartext traffic that comes in over port 8080.

HTTP->HTTPS redirection

Most websites that force HTTPS will also automatically redirect any requests that come into it over HTTP. In Ambassador Edge Stack, this is enabled by default but can easily be enabled in any version of Ambassador Edge Stack.

In Ambassador Edge Stack, this is configured by setting the insecure.action in a Host to Redirect.

Ambassador Edge Stack will then enable cleartext redrection in two ways.

First, Ambassador Edge Stack will listen on the insecure.additionalPort and consider any traffic on this port as insecure and redirect it to HTTPS.

Additionally, Ambassador Edge Stack will also check the X-Forwarded-Proto header of the incoming request on the secure port (8443)and issue a 301 redirect if it is set to HTTP.

The value of X-Forwarded-Proto is dependent on whatever is forwarding traffic to Ambassador Edge Stack. A couple of options are

• Layer 4 Load Balancer, Proxy, or direct from the client:

  X-Forwarded-Proto is not set or is untrusted. Envoy will set it based off the protocol of the incoming request.

  If Envoy determines the request is encrypted, it will be set to HTTPS. If not, it will be set to HTTP.

• Layer 7 Load Balancer or Proxy:

  X-Forwarded-Proto is set by the load balancer or proxy and trusted by Envoy. Envoy will trust the value of X-Forwarded-For even if the request comes in over cleartext.

  If you are using a layer 7 load balancer, it is critical that the system be configured correctly. The xff_num_trusted_hops element, although its name reflects X-Forwarded-For, is also used when determining trust for X-Forwarded-For, and it is therefore important to set it correctly. Its default of 0 should always be correct when Ambassador Edge Stack is behind only layer 4 load balancers. Note that in rare cases the load balancer may remove or impact these headers so checking that the defaults are in place is recommended.

Summary

Ambassador Edge Stack will enable cleartext redirection by default.

To enable cleartext redirection in any version of Ambassador Edge Stack, simply configure a Host to redirect cleartext to HTTPS like below: