how to set a global https redirect

[nwsparks]

I've researched pretty exhaustively looking for a way to globally redirect all http traffic to https without finding a solution.

i am interested in how to accomplish this both via kong and via the ingress controller helm chart.

The nginx ingress controller has such an option https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#auth-and-ssltls:~:text=False-,ssl%2Dredirect,-Sets%20an%20unconditional

and is configurable in their helm chart here https://artifacthub.io/packages/helm/ingress-nginx/ingress-nginx#:~:text=%5B%5D-,controller.config,-object

is there a way to set this that I am missing?

[nwsparks]

if anyone else stumbles across this i was able to accomplish it by setting a global plugin. there might be a more efficient function. this was just something i found.

https://docs.konghq.com/kubernetes-ingress-controller/2.11.x/guides/using-kongplugin-resource/#configuring-global-plugins

apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: https-redirect
  annotations:
    kubernetes.io/ingress.class: kong
  labels:
    global: "true"
plugin: pre-function
config:
  functions:
  - |
    if kong.request.get_header("X-Forwarded-Proto") == "http" then
      local host = kong.request.get_host()
        if host ~= "localhost" then
        local query = kong.request.get_path_with_query()
        local url = "https://" .. host ..query
        kong.response.set_header("Location",url)
        return kong.response.exit(308,url)
        end
    end

[nabouzidan-3as]

This kind of works, but it does not redirect "Not Found" routes. This will:

apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: https-redirect
  annotations:
    kubernetes.io/ingress.class: kong
  labels:
    global: "true"
plugin: pre-function
config:
  rewrite:
  - |
    local scheme = kong.request.get_scheme()
    if scheme == "http" then
      local host = kong.request.get_host()
      if host ~= "localhost" then
        local path = kong.request.get_path()
        local query = kong.request.get_raw_query()
        local url = "https://" .. host .. path
        if query and query ~= "" then
          url = url .. "?" .. query
        end
        kong.response.set_header("Location", url)
        return kong.response.exit(308)
      end
    end

[sdickhoven]

this was very helpful! thank you! 🙏

i have modified the above code to allow cluster tenants to influence the redirect behavior using the ingress annotations konghq.com/protocols and konghq.com/https-redirect-status-code:

apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: https-redirect
  annotations:
    kubernetes.io/ingress.class: kong
  labels:
    global: "true"
plugin: pre-function
config:
  access:
  - |
    local scheme = kong.request.get_scheme()
    if scheme == "http" then
      local host = kong.request.get_host()
      if host ~= "localhost" then
        local route = kong.router.get_route()
        if route.protocols["https"] then
          local status_code = route.https_redirect_status_code ~= 426 and route.https_redirect_status_code or 308
          if status_code == 301 or status_code == 302 or status_code == 307 or status_code == 308 then
            local url = "https://" .. host .. kong.request.get_path_with_query()
            kong.response.set_header("Location", url)
            return kong.response.exit(status_code)
          end
        end
      end
    end

the above code will not redirect if an ingress is decorated with

konghq.com/protocols: http

the redirect status code will be set to 308 by default (kong uses 426 by default which isn't a redirect) but that code can be changed with the ingress annotation

konghq.com/https-redirect-status-code: "307"

the above code never runs and kong reverts to its built-in 426 behavior if an ingress has the following annotation

konghq.com/protocols: https

this allows cluster tenants to opt out of https redirects and to return e.g. 301 instead of 308 which actually elicits different behavior from http clients when the request method is POST.

i haven't tested with grpc yet. i may have to modify the above code like so in order to also do redirects for grpc:

if scheme == "http" or scheme == "grpc" then
  ...
  if route.protocols["https"] or route.protocols["grpcs"] then
    ...
  end
  ...
end

...or something a bit more involved in case a route can support both grpc and http protocols. 🤷

ps: since i need access to the route details (kong.router.get_route()), my code cannot run earlier than the access phase.

route information is not available in the rewrite phase.

[gray63659-glitch]

Thank you for sharing this updated KongClusterPlugin configuration. The ability for cluster tenants to influence redirect behavior via ingress annotations is a great addition. Regarding your note on gRPC, please let us know if you find that modifying the scheme check to include "grpc" and "grpcs" works as expected or if it requires a more complex implementation for routes supporting both protocols.

…

On Wed, Jul 1, 2026, 8:32 AM Simon Dickhoven ***@***.***> wrote: this was very helpful! thank you! 🙏 i have modified the above code to allow cluster tenants to influence the redirect behavior using the ingress annotations konghq.com/protocols and konghq.com/https-redirect-status-code: apiVersion: configuration.konghq.com/v1kind: KongClusterPluginmetadata: name: https-redirect annotations: kubernetes.io/ingress.class: kong labels: global: "true"plugin: pre-functionconfig: access: - | local scheme = kong.request.get_scheme() if scheme == "http" then local host = kong.request.get_host() if host ~= "localhost" then local route = kong.router.get_route() if route.protocols["https"] then local status_code = route.https_redirect_status_code ~= 426 and route.https_redirect_status_code or 308 if status_code == 301 or status_code == 302 or status_code == 307 or status_code == 308 then local url = "https://" .. host .. kong.request.get_path_with_query() kong.response.set_header("Location", url) return kong.response.exit(status_code) end end end end the above code will *not* redirect if an ingress is decorated with konghq.com/protocols: http the redirect status code will be set to 308 by default (kong uses 426 by default which isn't a redirect) but that code can be changed with the ingress annotation konghq.com/https-redirect-status-code: "307" the above code never runs and kong reverts to its built-in 426 behavior if an ingress has the following annotation konghq.com/protocols: https this allows cluster tenants to opt out of https redirects and to return e.g. 301 instead of 308 which actually elicits *different* behavior from http clients when the request method is POST. i haven't tested with grpc yet. i may have to modify the above code like so in order to also do redirects for grpc: if scheme == "http" or scheme == "grpc" then ... if route.protocols["https"] or route.protocols["grpcs"] then ... endend ...or something a bit more involved in case a route can have both grpc and http protocols. 🤷 — Reply to this email directly, view it on GitHub <#11557?email_source=notifications&email_token=B72N4ZGFGPRLDFRBJAUAWX35CUHGNA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZUHE3TOMRZUZZGKYLTN5XKU43VMJZWG4TJMJSWJJLFOZSW45FMMZXW65DFOJPWG3DJMNVQ#discussioncomment-17497729>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/B72N4ZDIWJ5JKJI4NCQSKM35CUHGNAVCNFSNUABGKJSXA33TNF2G64TZHMZDMNZYGMZDSNJ3IRUXGY3VONZWS33OHM2TMMRQGA4TLILWAI> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/B72N4ZFFRCCQ7CCDF6JTXQD5CUHGNA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZUHE3TOMRZUZZGKYLTN5XKU43VMJZWG4TJMJSWJJLFOZSW45FKMZXW65DFOJPWS33T> and Android <https://github.com/notifications/mobile/android/B72N4ZBQI25AN42DLANF5I35CUHGNA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZUHE3TOMRZUZZGKYLTN5XKU43VMJZWG4TJMJSWJJLFOZSW45FOMZXW65DFOJPWC3TEOJXWSZA>. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[sdickhoven]

based on what i've read, it looks like grpc does not really have built-in redirect functionality and will therefore likely just be confused by 301/302/307/308 status codes. 🤷

plus you already have to explicitly instruct kong to "speak" grpc with the ingress annotation:

konghq.com/protocols: grpcs

...which is where you can express your desire to not allow plaintext grpc requests (which kong will then enforce):

$ grpcurl -plaintext my-grpc-server.example.com:80 info.InfoService/Info
Error invoking method "info.InfoService/Info": rpc error: code = Canceled desc = failed to query for service descriptor "info.InfoService": gRPC request matched gRPCs route

if you don't want your cluster tenants to allow plaintext grpc then it might be easier to configure an admission controller like gatekeeper to prevent them from adding the ingress annotation

konghq.com/protocols: grpc

(or, rather, the above annotation with a value that matches the regex \bgrpc\b)

the above plugin really just exists so that my cluster tenants don't have to add the ingress annotations

konghq.com/protocols: https
konghq.com/https-redirect-status-code: "308"

to get ingress-nginx's behavior of automatically redirecting http requests to https for all ingresses by default.

but i could also have set up a gatekeeper policy that would require them to add the above annotations to their ingresses... it's just not a very nice user experience.