Question

DigitalOcean Kubernetes Ingress redirect http->https

Posted on April 18, 2025
Kubernetes
Asked by Sam Darwin

Hi,

I just noticed something which is more of a curiosity than anything.

On an ‘ingress’ in DigitalOcean Kubernetes, if the “tls” section is filled out, and a cert-manager annotation is present, there appears to be an automatic http->https redirect happening in the browser.

At this stage, I have not installed cert-manager, nor installed actual TLS certificates. The cert says “Kubernetes Ingress Controller Fake Certificate”.

The point is that I have not set any specific annotations requesting http->https redirects.

That fact that it occurs is surprising.

When I remove all reference to tls and certs, the redirect disappears.

Where is this behavior coming from? Where is it documented and explained?

Perhaps we can imagine that it makes sense to assume you’d want such a redirect, whenever you install TLS certs. Otherwise why are you installing certs.

Thanks.

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Daniel Vigueras • April 19, 2025

Hi Sam,

according to the Ingress Nginx docs: https://kubernetes.github.io/ingress-nginx/user-guide/tls/#server-side-https-enforcement-through-redirect

By default the controller redirects HTTP clients to the HTTPS port 443 using a 308 Permanent Redirect response if TLS is enabled for that Ingress.

This can be disabled globally using ssl-redirect: "false" in the NGINX config map, or per-Ingress with the nginx.ingress.kubernetes.io/ssl-redirect: "false" annotation in the particular resource.

If TLS is defined, most people want to use HTTPS exclusively and this redirection seems to be the default behavior as soon as you enable TLS. Use the above annotation to disable it if you don’t want/need it.

Daniel, Founder of Deckrun