Detect Upstream Protocol with appProtocol

Goal

Configure the Ingress Controller to detect a backend Service's expected upstream protocol from the appProtocol field on the Service port.

Before you begin

• Complete Set Up Ingress Controller and Gateway.
• You have kubectl configured against the cluster used in the setup guide.
• You have jq installed to view the Admin API response.
• The examples use APISIX in standalone mode with the Admin API on port 9180. Replace APISIX_ADMIN_KEY with your Admin API key.

Set the variables this guide uses:

export GATEWAY_ADMIN_SERVICE="apisix-admin"
export ADMIN_API_PORT="9180"
export ADMIN_API_FORWARD_PORT="9180"
export APISIX_ADMIN_URL="http://127.0.0.1:${ADMIN_API_FORWARD_PORT}"
export APISIX_ADMIN_KEY="YOUR_ADMIN_KEY"   # replace with your Admin API key

Steps

Step 1: Create the example Service with appProtocol

Create a manifest for the httpbin Service that defines two ports with different appProtocol values:

apiVersion: v1
kind: Service
metadata:
  namespace: aic
  name: httpbin
spec:
  selector:
    app: httpbin
  ports:
    - name: http
      port: 80
      targetPort: 80
      appProtocol: http
    - name: https
      port: 443
      targetPort: 443
      appProtocol: https

Apply the manifest:

kubectl apply -f httpbin-service.yaml

Step 2: Create a route that references the https port

Create a route that points to the Service port 443. The Ingress Controller reads appProtocol: https from that port and sets the upstream scheme to https automatically.

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  namespace: aic
  name: httpbin-route
spec:
  parentRefs:
  - name: apisix
  rules:
  - matches:
    - path:
        type: Exact
        value: /anything
    backendRefs:
    - name: httpbin
      port: 443

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: aic
  name: httpbin-route
spec:
  ingressClassName: apisix
  rules:
    - http:
        paths:
          - path: /anything
            pathType: Exact
            backend:
              service:
                name: httpbin
                port:
                  number: 443

apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  namespace: aic
  name: httpbin-route
spec:
  ingressClassName: apisix
  http:
  - name: httpbin-route
    match:
      paths:
      - /anything
    backends:
    - serviceName: httpbin
      servicePort: 443

Apply the manifest:

kubectl apply -f httpbin-https.yaml

Validate

Forward the APISIX Admin API port to your local machine:

kubectl port-forward "service/${GATEWAY_ADMIN_SERVICE}" "${ADMIN_API_FORWARD_PORT}:${ADMIN_API_PORT}" -n aic &

Query the Admin API for the gateway configuration and inspect the upstream scheme:

curl "${APISIX_ADMIN_URL}/apisix/admin/configs" -H "X-API-KEY: ${APISIX_ADMIN_KEY}" | jq

In the upstreams section of the response, the scheme for the managed upstream should be https:

{
  "scheme": "https",
  "labels": {
    "managed-by": "apisix-ingress-controller"
  },
  "name": "aic_httpbin-route_0",
  "id": "..."
}

If you are using API7 Enterprise, the API7 Dashboard should also show the upstream scheme set to https.

Roll back / Clean up

Delete the manifests created in this guide:

kubectl delete -f httpbin-https.yaml
kubectl delete -f httpbin-service.yaml

Stop the local port-forward process if it is still running:

kill %1 2>/dev/null || true

Troubleshoot

Related

• Set Up Ingress Controller and Gateway
• Proxy WebSocket Connections
• Proxy gRPC Traffic
• Reference: Annotations