Merge pull request #6581 from dokku/tls-handling

Fix issues in tls handling when deploying via k3s

plugins/scheduler-k3s/functions.go

@@ -149,16 +149,18 @@ func applyClusterIssuers(ctx context.Context) error {
 	clusterIssuerValues := ClusterIssuerValues{
 		ClusterIssuers: map[string]ClusterIssuer{
 			"letsencrypt-stag": {
-				Email:   letsencryptEmailStag,
-				Enabled: letsencryptEmailStag != "",
-				Name:    "letsencrypt-stag",
-				Server:  "https://acme-staging-v02.api.letsencrypt.org/directory",
+				Email:        letsencryptEmailStag,
+				Enabled:      letsencryptEmailStag != "",
+				IngressClass: getGlobalIngressClass(),
+				Name:         "letsencrypt-stag",
+				Server:       "https://acme-staging-v02.api.letsencrypt.org/directory",
 			},
 			"letsencrypt-prod": {
-				Email:   letsencryptEmailProd,
-				Enabled: letsencryptEmailProd != "",
-				Name:    "letsencrypt-prod",
-				Server:  "https://acme-v02.api.letsencrypt.org/directory",
+				Email:        letsencryptEmailProd,
+				Enabled:      letsencryptEmailProd != "",
+				IngressClass: getGlobalIngressClass(),
+				Name:         "letsencrypt-prod",
+				Server:       "https://acme-v02.api.letsencrypt.org/directory",
 			},
 		},
 	}
@@ -496,7 +498,7 @@ func getComputedImagePullSecrets(appName string) string {
 }
 
 func getGlobalIngressClass() string {
-	return common.PropertyGetDefault("scheduler-k3s", "global", "ingress-class", DefaultIngressClass)
+	return common.PropertyGetDefault("scheduler-k3s", "--global", "ingress-class", DefaultIngressClass)
 }
 
 func getIngressAnnotations(appName string, processType string) (map[string]string, error) {

plugins/scheduler-k3s/template.go

@@ -161,12 +161,11 @@ type ProcessCron struct {
 }
 
 type ProcessPortMap struct {
-	ContainerPort   int32           `yaml:"container_port"`
-	HostPort        int32           `yaml:"host_port"`
-	Scheme          string          `yaml:"scheme"`
-	Protocol        PortmapProtocol `yaml:"protocol"`
-	Name            string          `yaml:"name"`
-	RedirectToHttps bool            `yaml:"redirect_to_https"`
+	ContainerPort int32           `yaml:"container_port"`
+	HostPort      int32           `yaml:"host_port"`
+	Scheme        string          `yaml:"scheme"`
+	Protocol      PortmapProtocol `yaml:"protocol"`
+	Name          string          `yaml:"name"`
 }
 
 type PortmapProtocol string

plugins/scheduler-k3s/templates/chart/deployment.yaml

@@ -1,5 +1,9 @@
 {{- $processName := "PROCESS_NAME" }}
 {{- $config := index .Values.processes "PROCESS_NAME" }}
+{{- $mappings := dict }}
+{{- range $pdx, $port_map := $config.web.port_maps }}
+{{- $mappings := set $mappings $port_map.name "true" }}
+{{- end }}
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -76,6 +80,9 @@ spec:
         {{- if eq $processName "web" }}
         ports:
         {{- range $pdx, $port_map := $config.web.port_maps }}
+        {{- if and (eq $port_map.scheme "https") (hasKey $mappings (printf "http-80-%.0f" $port_map.container_port)) }}
+        {{- continue }}
+        {{- end }}
         - containerPort: {{ $port_map.container_port }}
           name: {{ $port_map.name }}
           protocol: {{ $port_map.protocol }}

plugins/scheduler-k3s/templates/chart/ingress-route.yaml

@@ -1,7 +1,14 @@
 {{- $processName := "PROCESS_NAME" }}
 {{- $config := index .Values.processes "PROCESS_NAME" }}
 {{- if and $config.web.domains (eq $.Values.global.network.ingress_class "traefik") }}
+{{- $mappings := dict }}
 {{- range $pdx, $port_map := $config.web.port_maps }}
+{{- $mappings := set $mappings $port_map.name "true" }}
+{{- end }}
+{{- range $pdx, $port_map := $config.web.port_maps }}
+{{- if and (eq $port_map.scheme "https") (hasKey $mappings (printf "http-80-%.0f" $port_map.container_port)) }}
+{{- continue }}
+{{- end }}
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -26,16 +33,15 @@ metadata:
   namespace: {{ $.Values.global.namespace }}
 spec:
   entryPoints:
-  {{- if and $config.web.tls.enabled (eq $port_map.scheme "https") }}
+  {{- if $config.web.tls.enabled }}
   - websecure
-  {{- else }}
-  - web
   {{- end }}
+  - web
   routes:
     {{- range $ddx, $domain := $config.web.domains }}
     - kind: Rule
       match: Host(`{{ $domain }}`)
-      {{- if and $config.web.tls.enabled (and (eq $port_map.scheme "http") $port_map.redirect_to_https) }}
+      {{- if $config.web.tls.enabled }}
       middlewares:
         - name: {{ $.Values.global.app_name}}-{{ $processName }}-redirect-to-https
           namespace: {{ $.Values.global.namespace }}
@@ -47,7 +53,7 @@ spec:
         port: {{ $port_map.name }}
         scheme: http
     {{- end }}
-  {{- if and $config.web.tls.enabled (eq $port_map.scheme "https") }}
+  {{- if $config.web.tls.enabled }}
   tls:
     secretName: tls-{{ $.Values.global.app_name }}-{{ $processName }}
   {{- end }}

plugins/scheduler-k3s/templates/chart/ingress.yaml

@@ -1,7 +1,14 @@
 {{- $processName := "PROCESS_NAME" }}
 {{- $config := index .Values.processes "PROCESS_NAME" }}
 {{- if and $config.web.domains (eq $.Values.global.network.ingress_class "nginx") }}
+{{- $mappings := dict }}
 {{- range $pdx, $port_map := $config.web.port_maps }}
+{{- $mappings := set $mappings $port_map.name "true" }}
+{{- end }}
+{{- range $pdx, $port_map := $config.web.port_maps }}
+{{- if and (eq $port_map.scheme "https") (hasKey $mappings (printf "http-80-%.0f" $port_map.container_port)) }}
+{{- continue }}
+{{- end }}
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -18,6 +25,9 @@ metadata:
     {{ $k }}: {{ $v | quote }}
     {{- end }}
     {{- end }}
+    {{- if $config.web.tls.enabled }}
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    {{- end }}
   labels:
     app.kubernetes.io/instance: {{ $.Values.global.app_name }}-{{ $processName }}
     app.kubernetes.io/name: {{ $processName }}
@@ -26,7 +36,7 @@ metadata:
   namespace: {{ $.Values.global.namespace }}
 spec:
   ingressClassName: nginx
-  {{- if and $config.web.tls.enabled (eq $port_map.scheme "https") }}
+  {{- if $config.web.tls.enabled }}
   tls:
     - hosts:
       {{- range $ddx, $domain := $config.web.domains }}

plugins/scheduler-k3s/triggers.go

@@ -351,7 +351,7 @@ func TriggerSchedulerDeploy(scheduler string, appName string, imageTag string) e
 			},
 			Namespace: namespace,
 			Network: GlobalNetwork{
-				IngressClass: common.PropertyGetDefault("scheduler-k3s", "--global", "ingress-class", DefaultIngressClass),
+				IngressClass: getGlobalIngressClass(),
 				PrimaryPort:  primaryPort,
 			},
 			Secrets: map[string]string{},
@@ -417,20 +417,39 @@ func TriggerSchedulerDeploy(scheduler string, appName string, imageTag string) e
 					protocol = PortmapProtocol_UDP
 				}
 
-				redirecToHttps := false
-				if _, ok := portMaps[fmt.Sprintf("https-443-%d", portMap.ContainerPort)]; ok && portMap.Scheme == "http" {
-					redirecToHttps = true
-				}
 				processValues.Web.PortMaps = append(processValues.Web.PortMaps, ProcessPortMap{
-					ContainerPort:   portMap.ContainerPort,
-					HostPort:        portMap.HostPort,
-					Name:            portMap.String(),
-					Protocol:        protocol,
-					RedirectToHttps: redirecToHttps,
-					Scheme:          portMap.Scheme,
+					ContainerPort: portMap.ContainerPort,
+					HostPort:      portMap.HostPort,
+					Name:          portMap.String(),
+					Protocol:      protocol,
+					Scheme:        portMap.Scheme,
 				})
 			}
 
+			for _, portMap := range processValues.Web.PortMaps {
+				_, httpOk := portMaps[fmt.Sprintf("http-80-%d", portMap.ContainerPort)]
+				_, httpsOk := portMaps[fmt.Sprintf("https-443-%d", portMap.ContainerPort)]
+				if portMap.Scheme == "http" && !httpsOk && tlsEnabled {
+					processValues.Web.PortMaps = append(processValues.Web.PortMaps, ProcessPortMap{
+						ContainerPort: portMap.ContainerPort,
+						HostPort:      443,
+						Name:          fmt.Sprintf("https-443-%d", portMap.ContainerPort),
+						Protocol:      PortmapProtocol_TCP,
+						Scheme:        "https",
+					})
+				}
+
+				if portMap.Scheme == "https" && !httpOk {
+					processValues.Web.PortMaps = append(processValues.Web.PortMaps, ProcessPortMap{
+						ContainerPort: portMap.ContainerPort,
+						HostPort:      80,
+						Name:          fmt.Sprintf("http-80-%d", portMap.ContainerPort),
+						Protocol:      PortmapProtocol_TCP,
+						Scheme:        "http",
+					})
+				}
+			}
+
 			sort.Sort(NameSorter(processValues.Web.PortMaps))
 			sort.Strings(processValues.Web.Domains)
 		}