Proxy Requests to HTTPS Upstream Services

Learn how to use APISIX or API7 Ingress Controller to configure the gateway to forward traffic to upstream services over HTTPS.

Applies to:API7 Ingress Controller (drives API7 Gateway)APISIX Ingress Controller (drives Apache APISIX)

Goal

Configure the gateway to proxy HTTP requests to an upstream service that only accepts HTTPS connections.

Before you begin

Complete Set Up Ingress Controller and Gateway.
You have kubectl configured against the cluster used in the setup guide.

Set the variable this guide uses:

export GATEWAY_URL="http://127.0.0.1:9080"   # kubectl port-forward, or your Service's address

To proxy requests to an HTTPS upstream, create a route that forwards traffic to an upstream service over TLS. The following example configures a route to the public upstream service httpbin.org on its HTTPS port 443.

https-route.yaml

apiVersion: v1
kind: Service
metadata:
  namespace: aic
  name: httpbin-external-domain
spec:
  type: ExternalName
  externalName: httpbin.org
---
apiVersion: apisix.apache.org/v1alpha1
kind: BackendTrafficPolicy
metadata:
  namespace: aic
  name: passhost-node
spec:
  targetRefs:
  - name: httpbin-external-domain
    kind: Service
    group: ""
  passHost: node
  scheme: https
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  namespace: aic
  name: httpbin-tls
spec:
  parentRefs:
  - name: apisix
  rules:
  - matches:
    - path:
        type: Exact
        value: /ip
    backendRefs:
    - name: httpbin-external-domain
      port: 443

https-route.yaml

apiVersion: apisix.apache.org/v2
kind: ApisixUpstream
metadata:
  namespace: aic
  name: httpbin-external-domain
spec:
  ingressClassName: apisix
  scheme: https
  passHost: node
  externalNodes:
  - type: Domain
    name: httpbin.org
    port: 443
---
apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  namespace: aic
  name: httpbin-tls
spec:
  ingressClassName: apisix
  http:
    - name: httpbin-tls
      match:
        paths:
          - /ip
      upstreams:
      - name: httpbin-external-domain

Step 2: Apply the route configuration

Apply the manifest to your cluster:

kubectl apply -f https-route.yaml

Validate

Send a request to the route through the gateway:

curl -i "${GATEWAY_URL}/ip"

Expected: an HTTP/1.1 200 OK response, which verifies that the gateway has successfully established a connection and communicated with the upstream service over HTTPS.

Roll back / Clean up

Delete the route manifest created in this guide:

kubectl delete -f https-route.yaml

Troubleshoot

Symptom	Cause	Fix
`curl` returns `502` or `503`.	The gateway cannot establish TLS to the upstream, or the upstream hostname is not passed correctly.	Confirm the `BackendTrafficPolicy` or `ApisixUpstream` uses `scheme: https` and `passHost: node`, and that the backend port is `443`.
`curl` returns `404`.	The route is not reconciled, or the path does not match.	Check that the HTTPRoute or ApisixRoute `parentRefs` resolve and that the path is `/ip`.
`curl` cannot connect to the gateway.	The gateway is not reachable at `GATEWAY_URL`, or the port-forward is not running.	Verify the gateway Service is exposed and that `GATEWAY_URL` matches your environment.