# Kubernetes Ingress annotation doesn't force HTTPS to backend pods **URL:** \ **Category:** Traefik v2\ **Tags:** kubernetes-ingress\ **Created:** [July 28, 2019, 1:15pm UTC](https://community.traefik.io/t/kubernetes-ingress-annotation-doesnt-force-https-to-backend-pods/1056 "2019-07-28T13:15:56Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![seh](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/seh/32/487_2.png) [@seh](https://community.traefik.io/u/seh)\ **Post date:** [July 28, 2019, 1:15pm UTC](https://community.traefik.io/t/kubernetes-ingress-annotation-doesnt-force-https-to-backend-pods/1056/1 "2019-07-28T13:15:56Z")
According to the documentation on the Kubernetes Ingress provide, there are [three ways to tell Traefik to use HTTPS to talk to the backend pods](https://docs.traefik.io/configuration/backends/kubernetes/#tls-communication-between-traefik-and-backend-pods). I can't get the third technique to work: > 1. If the ingress spec includes the annotation `ingress.kubernetes.io/protocol: https`. When I include that annotation in my _Ingress_ object, Traefik still registers the server using HTTP, not HTTPS. If I name my Kubernetes _Service_ port "https," then Traefik uses HTTPS to talk to the pods, regardless of the presence of the annotation. I'm using Traefik version 2.0.0-beta1. Is this documentation supposed to apply to this version? ---
**Author:** ![seh](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/seh/32/487_2.png) [@seh](https://community.traefik.io/u/seh)\ **Post date:** [July 29, 2019, 11:55am UTC](https://community.traefik.io/t/kubernetes-ingress-annotation-doesnt-force-https-to-backend-pods/1056/2 "2019-07-29T11:55:27Z")
Looking in file _pkg/provider/kubernetes/ingress/kubernetes.go_ at [the `loadService` function](https://github.com/containous/traefik/blob/06df6017dfc4464b81106e22bd7fcc61de5c3786/pkg/provider/kubernetes/ingress/kubernetes.go#L167-L246), I don't see this annotation taken into account [when determining the protocol with which to contact the backend servers](https://github.com/containous/traefik/blob/06df6017dfc4464b81106e22bd7fcc61de5c3786/pkg/provider/kubernetes/ingress/kubernetes.go#L227-L230). ---
**Author:** ![seh](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/seh/32/487_2.png) [@seh](https://community.traefik.io/u/seh)\ **Post date:** [July 29, 2019, 7:55pm UTC](https://community.traefik.io/t/kubernetes-ingress-annotation-doesnt-force-https-to-backend-pods/1056/3 "2019-07-29T19:55:38Z")
That file reference does cover Traefik version 2; it refers to the wrong branch. The location for the "v2.0" branch is [here](https://github.com/containous/traefik/blob/v2.0/pkg/provider/kubernetes/ingress/kubernetes.go#L227-L230). Unfortunately, it looks like this variant still only supports the first two predicates: - The _Endpoints_ port is 443 - The _Service_ port name starts with "https" ---
**Author:** ![seh](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/seh/32/487_2.png) [@seh](https://community.traefik.io/u/seh)\ **Post date:** [July 29, 2019, 8:05pm UTC](https://community.traefik.io/t/kubernetes-ingress-annotation-doesnt-force-https-to-backend-pods/1056/4 "2019-07-29T20:05:17Z")
By the way, I think I may have written this elsewhere, but I find the first predicate rule to be surprising, and not as convenient as it could be. It's looking at the _Endpoints_ port (which is usually the target container port), and **not** at the _Service_ port. We usually deny our pods the ability to bind to privileged ports, so we'll find pods listening on, say, port 8443, with a _Service_ in front of them listening on port 443, forwarding to port 8443. When Traefik finds such an _Endpoint_, it decides that it doesn't look like it's using HTTPS, because port 8443 is obviously not port 443. However, if Traefik were to look at the _Service_—which it's watching and caching in memory—it could see that the _Service_ port is 443, which is a strong hint that its clients are expecting to use HTTPS. Was this design discussed publicly? I'm wondering if this alternate predicate was debated. I understand that Traefik is ultimately routing to _Endpoints_, and not _Service_s, but for this situation the intention is better represented in the _Service_. ---
**Author:** ![seh](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/seh/32/487_2.png) [@seh](https://community.traefik.io/u/seh)\ **Post date:** [July 29, 2019, 8:10pm UTC](https://community.traefik.io/t/kubernetes-ingress-annotation-doesnt-force-https-to-backend-pods/1056/5 "2019-07-29T20:10:00Z")
The first predicate mentioned [here](https://docs.traefik.io/configuration/backends/kubernetes/#tls-communication-between-traefik-and-backend-pods) reads as follows: > 1. If the service port defined in the ingress spec is 443 (note that you can still use `targetPort` to use a different port on your pod). That tells me that the current implementation is mistaken; the _Ingress_ port matches the _Service_'s front-end port, and **not** the port mentioned in the _Endpoints_. In other words, [this code block](https://github.com/containous/traefik/blob/v2.0/pkg/provider/kubernetes/ingress/kubernetes.go#L216-L228) is looking at the wrong port value. At [line 218](https://github.com/containous/traefik/blob/v2.0/pkg/provider/kubernetes/ingress/kubernetes.go#L218), the port value it's capturing is the _Service_'s **target port** (the port on which the container is listening). The "portSpec" variable in scope and [assigned at line 185](https://github.com/containous/traefik/blob/v2.0/pkg/provider/kubernetes/ingress/kubernetes.go#L185) could be consulted instead. ---
**Author:** ![daniel.tomcej](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/daniel.tomcej/32/262_2.png) [@daniel.tomcej](https://community.traefik.io/u/daniel.tomcej)\ **Post date:** [July 29, 2019, 8:15pm UTC](https://community.traefik.io/t/kubernetes-ingress-annotation-doesnt-force-https-to-backend-pods/1056/6 "2019-07-29T20:15:58Z")
Hello @seh, The documentation is versioned. The default version of the documentation is for the latest stable version (currently 1.7.12). If you want a different version, there is a version selector on the left hand side of the documentation. As for the forcing of https communication with backend pods: As per the documentation for 1.7: ( [https://docs.traefik.io/v1.7/configuration/backends/kubernetes/#tls-communication-between-traefik-and-backend-pods](https://docs.traefik.io/v1.7/configuration/backends/kubernetes/#tls-communication-between-traefik-and-backend-pods)) There are 3 ways to configure Traefik to use https to communicate with backend pods: 1. If the service port defined in the ingress spec is 443 (note that you can still use `targetPort` to use a different port on your pod). 2. If the service port defined in the ingress spec has a name that starts with `https` (such as `https-api` , `https-web` or just `https` ). 3. If the ingress spec includes the annotation `ingress.kubernetes.io/protocol: https` . All 3 of these are extensively tested, and confirmed. For Traefik version 2, the provider has been rewritten. If you feel there is a bug in the code, feel free to open a github ticket, and reference the issue you are encountering. ---
**Author:** ![seh](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/seh/32/487_2.png) [@seh](https://community.traefik.io/u/seh)\ **Post date:** [July 30, 2019, 12:47am UTC](https://community.traefik.io/t/kubernetes-ingress-annotation-doesnt-force-https-to-backend-pods/1056/7 "2019-07-30T00:47:59Z")
Please see [issue 5164](https://github.com/containous/traefik/issues/5164).