Templating nginx.ingress.tmpl proxy_pass not set when backend-protocol annotation is set

[chris8205]

What happened:

nginx-ingress can't get response from https-backend-(service)

2024/07/16 14:12:02 [error] 48#48: *32 upstream sent no valid HTTP/1.0 header while reading response header from upstream, client: xxx.xxx.xxx.xxx, server: myhost-fqdn, request: "GET /xxxx/xxxxxxxx?xxxx HTTP/1.1", upstream: "http://xxx.xxx.6.3:8443/xxxx/xxxxxxxx?xxxx", host: "myhost-fqdn"

What you expected to happen:

in the template proxy_pass seems to be "broken"

                   {{- if $location.SSL}}
                proxy_pass https://{{$location.Upstream.Name}}{{$location.Rewrite}};
                {{- else}}
                proxy_pass http://{{$location.Upstream.Name}}{{$location.Rewrite}};
                {{- end}}

the following annotation is set...

  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS

NGINX Ingress controller version nginx/nginx-ingress:3.6.1

Kubernetes version (use kubectl version): v1.29.4

Environment: Azure K8s

Hope this information are sufficient; maybe i use the wrong annotation; but i can't find the corresponding to set the "flag" to enforce the {{- if $location.SSL}}

!!! We don't want to pass-thru SSL directly to the back-end !!!

[github-actions[bot]]

Hi @chris8205 thanks for reporting!

Be sure to check out the docs and the Contributing Guidelines while you wait for a human to take a look at this :slightly_smiling_face:

I've parsed the text of your issue and it looks like you might be mixing up the two Ingress Controllers, please take a look at this page to see the differences between nginxinc/kubernetes-ingress (this repo) and kubernetes/ingress-nginx.

Cheers!

[vepatel]

Hi @chris8205 nginx.ingress.kubernetes.io/backend-protocol: HTTPS isn't a valid annotation for this project unfortunately, this belongs to k8s community ingress controller for this project you can try nginx.org/ssl-services, something like:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: <my_ingress>
  annotations:
    nginx.org/ssl-services: "<svc1>,<svc2>"
spec:
  ingressClassName:<my_ingress_class>
.
.
.

see: https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#summary-of-annotations Example: https://github.com/nginxinc/kubernetes-ingress/tree/v3.6.1/examples/ingress-resources/ssl-services

[hamelchRIT]

Thank You, to many different helm charts out there ;)

[vepatel]

hi @chris8205 is your issue now resolved?

[chris8205]

@vepatel Yes this one is done...