diff --git a/stable/artifactory-ha/files/nginx-artifactory-conf.yaml b/stable/artifactory-ha/files/nginx-artifactory-conf.yaml index 89a8baa9b..dcaf8ac0e 100644 --- a/stable/artifactory-ha/files/nginx-artifactory-conf.yaml +++ b/stable/artifactory-ha/files/nginx-artifactory-conf.yaml @@ -63,12 +63,18 @@ location / { proxy_cookie_path ~*^/.* /; proxy_pass {{ include "artifactory-ha.scheme" . }}://{{ include "artifactory-ha.fullname" . }}:{{ .Values.artifactory.externalPort }}/; {{- if .Values.nginx.service.ssloffload}} + {{- if .Values.nginx.service.ssloffloadForceHttps}} + proxy_set_header X-JFrog-Override-Base-Url https://$host; + proxy_set_header X-Forwarded-Proto https; + {{- else }} proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host; + proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; + {{- end }} {{- else }} proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host:$host_port; proxy_set_header X-Forwarded-Port $server_port; - {{- end }} proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; + {{- end }} proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; {{- if .Values.nginx.disableProxyBuffering}} diff --git a/stable/artifactory-ha/templates/nginx-service.yaml b/stable/artifactory-ha/templates/nginx-service.yaml index 4f3bb58a1..604831cfe 100644 --- a/stable/artifactory-ha/templates/nginx-service.yaml +++ b/stable/artifactory-ha/templates/nginx-service.yaml @@ -64,7 +64,7 @@ spec: {{- if .Values.nginx.https }} {{- if or .Values.nginx.https.enabled .Values.nginx.service.ssloffload }} - port: {{ .Values.nginx.https.externalPort }} - {{- if .Values.nginx.service.ssloffload }} + {{- if and .Values.nginx.service.ssloffload (not .Values.nginx.service.ssloffloadForceHttps) }} targetPort: {{ .Values.nginx.http.internalPort }} {{- else }} targetPort: {{ .Values.nginx.https.internalPort}} diff --git a/stable/artifactory-ha/values.yaml b/stable/artifactory-ha/values.yaml index 0affa3d69..12a0b5223 100644 --- a/stable/artifactory-ha/values.yaml +++ b/stable/artifactory-ha/values.yaml @@ -1628,6 +1628,8 @@ nginx: ## @param service.ipFamilyPolicy Controller Service ipFamilyPolicy (optional, cloud specific) ## This can be either SingleStack, PreferDualStack or RequireDualStack ## ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services + + ssloffloadForceHttps: false ## ipFamilyPolicy: "" ## @param service.ipFamilies Controller Service ipFamilies (optional, cloud specific) diff --git a/stable/artifactory/files/nginx-artifactory-conf.yaml b/stable/artifactory/files/nginx-artifactory-conf.yaml index 8ee5e53dd..4bb930acc 100644 --- a/stable/artifactory/files/nginx-artifactory-conf.yaml +++ b/stable/artifactory/files/nginx-artifactory-conf.yaml @@ -63,12 +63,18 @@ location / { proxy_cookie_path ~*^/.* /; proxy_pass {{ include "artifactory.scheme" . }}://{{ include "artifactory.fullname" . }}:{{ .Values.artifactory.externalPort }}/; {{- if .Values.nginx.service.ssloffload}} + {{- if .Values.nginx.service.ssloffloadForceHttps}} + proxy_set_header X-JFrog-Override-Base-Url https://$host; + proxy_set_header X-Forwarded-Proto https; + {{- else }} proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host; + proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; + {{- end }} {{- else }} proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host:$host_port; proxy_set_header X-Forwarded-Port $server_port; - {{- end }} proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; + {{- end }} proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; {{- if .Values.nginx.disableProxyBuffering}} diff --git a/stable/artifactory/templates/nginx-service.yaml b/stable/artifactory/templates/nginx-service.yaml index 7204d9f46..29fb9132d 100644 --- a/stable/artifactory/templates/nginx-service.yaml +++ b/stable/artifactory/templates/nginx-service.yaml @@ -58,7 +58,7 @@ spec: {{- if .Values.nginx.https }} {{- if or .Values.nginx.https.enabled .Values.nginx.service.ssloffload }} - port: {{ .Values.nginx.https.externalPort }} - {{- if .Values.nginx.service.ssloffload }} + {{- if and .Values.nginx.service.ssloffload (not .Values.nginx.service.ssloffloadForceHttps) }} targetPort: {{ .Values.nginx.http.internalPort }} {{- else }} targetPort: {{ .Values.nginx.https.internalPort}} diff --git a/stable/artifactory/values.yaml b/stable/artifactory/values.yaml index ff9a6b33f..17296599c 100644 --- a/stable/artifactory/values.yaml +++ b/stable/artifactory/values.yaml @@ -1481,6 +1481,10 @@ nginx: ## @param service.ipFamilyPolicy Controller Service ipFamilyPolicy (optional, cloud specific) ## This can be either SingleStack, PreferDualStack or RequireDualStack ## ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services + + ## @param service.ssloffloadForceHttps Override http_x_forwarded_proto flag for external ingress (optional, likely OpenShift specific for ClusterIP based nginx service config) + ssloffloadForceHttps: false + ## ipFamilyPolicy: "" ## @param service.ipFamilies Controller Service ipFamilies (optional, cloud specific)