feat: add support for http-to-https redirect annotation (#484)

docs/en/latest/concepts/annotations.md

@@ -96,4 +96,38 @@ spec:
               number: 80
 ```
 
-With this Ingress, any requests with `/app` prefix will be forwarded to backend without the `/app/` part, e.g. request `/app/ip` will be forwarded to `/ip`.  
+With this Ingress, any requests with `/app` prefix will be forwarded to backend without the `/app/` part, e.g. request `/app/ip` will be forwarded to `/ip`.
+
+Redirect
+---------
+
+You can use the following annotations to control the redirect behavior.
+
+* `k8s.apisix.apache.org/http-to-https`
+
+If this annotation set to `true` and the request is HTTP, it will be automatically redirected to HTTPS with 301 response code,
+and the URI will keep the same as client request.
+
+For example, the following Ingress, if we set `k8s.apisix.apache.org/http-to-https: "true"`. The client will get a response with 301 status code, and the response header `Location`  will be `https://httpbin.org/sample`.
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: apisix
+    k8s.apisix.apache.org/http-to-https: "true"
+  name: ingress-v1
+spec:
+  rules:
+  - host: httpbin.org
+    http:
+      paths:
+      - path: /sample
+        pathType: Exact
+        backend:
+          service:
+            name: httpbin
+            port:
+              number: 80
+```

pkg/kube/translation/annotations.go

@@ -27,6 +27,7 @@ var (
 		annotations.NewCorsHandler(),
 		annotations.NewIPRestrictionHandler(),
 		annotations.NewRewriteHandler(),
+		annotations.NewRedirectHandler(),
 	}
 )
 

pkg/kube/translation/annotations/redirect.go

@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package annotations
+
+import (
+	apisixv1 "github.com/apache/apisix-ingress-controller/pkg/types/apisix/v1"
+)
+
+const (
+	_httpToHttps = "k8s.apisix.apache.org/http-to-https"
+)
+
+type redirect struct{}
+
+// NewRedirectHandler creates a handler to convert
+// annotations about redirect control to APISIX redirect plugin.
+func NewRedirectHandler() Handler {
+	return &redirect{}
+}
+
+func (r *redirect) PluginName() string {
+	return "redirect"
+}
+
+func (r *redirect) Handle(e Extractor) (interface{}, error) {
+	var plugin apisixv1.RedirectConfig
+	plugin.HttpToHttps = e.GetBoolAnnotation(_httpToHttps)
+	return &plugin, nil
+}

pkg/types/apisix/v1/plugin_types.go

@@ -55,3 +55,9 @@ type RewriteConfig struct {
 	RewriteTarget      string   `json:"uri,omitempty"`
 	RewriteTargetRegex []string `json:"regex_uri,omitempty"`
 }
+
+// RedirectConfig is the rule config for redirect plugin.
+// +k8s:deepcopy-gen=true
+type RedirectConfig struct {
+	HttpToHttps bool `json:"http_to_https,omitempty"`
+}

test/e2e/annotations/redirect.go

@@ -0,0 +1,122 @@
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package annotations
+
+import (
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/onsi/ginkgo"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/apache/apisix-ingress-controller/test/e2e/scaffold"
+)
+
+var _ = ginkgo.Describe("redirect annotations", func() {
+	s := scaffold.NewDefaultScaffold()
+
+	ginkgo.It("redirect http-to-https in ingress networking/v1", func() {
+		backendSvc, backendPort := s.DefaultHTTPBackend()
+		ing := fmt.Sprintf(`
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: apisix
+    k8s.apisix.apache.org/http-to-https: "true"
+  name: ingress-v1
+spec:
+  rules:
+  - host: httpbin.org
+    http:
+      paths:
+      - path: /sample
+        pathType: Exact
+        backend:
+          service:
+            name: %s
+            port:
+              number: %d
+`, backendSvc, backendPort[0])
+		err := s.CreateResourceFromString(ing)
+		assert.Nil(ginkgo.GinkgoT(), err, "creating ingress")
+		time.Sleep(5 * time.Second)
+
+		resp := s.NewAPISIXClient().GET("/sample").WithHeader("Host", "httpbin.org").Expect()
+		resp.Status(http.StatusMovedPermanently)
+		resp.Header("Location").Equal("https://httpbin.org/sample")
+	})
+
+	ginkgo.It("redirect http-to-https in ingress networking/v1beta1", func() {
+		backendSvc, backendPort := s.DefaultHTTPBackend()
+		ing := fmt.Sprintf(`
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: apisix
+    k8s.apisix.apache.org/http-to-https: "true"
+  name: ingress-v1beta1
+spec:
+  rules:
+  - host: httpbin.org
+    http:
+      paths:
+      - path: /sample
+        pathType: Exact
+        backend:
+          serviceName: %s
+          servicePort: %d
+`, backendSvc, backendPort[0])
+		err := s.CreateResourceFromString(ing)
+		assert.Nil(ginkgo.GinkgoT(), err, "creating ingress")
+		time.Sleep(5 * time.Second)
+
+		resp := s.NewAPISIXClient().GET("/sample").WithHeader("Host", "httpbin.org").Expect()
+		resp.Status(http.StatusMovedPermanently)
+		resp.Header("Location").Equal("https://httpbin.org/sample")
+	})
+
+	ginkgo.It("redirect http-to-https in ingress extensions/v1beta1", func() {
+		backendSvc, backendPort := s.DefaultHTTPBackend()
+		ing := fmt.Sprintf(`
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  annotations:
+    kubernetes.io/ingress.class: apisix
+    k8s.apisix.apache.org/http-to-https: "true"
+  name: ingress-extensions-v1beta1
+spec:
+  rules:
+  - host: httpbin.org
+    http:
+      paths:
+      - path: /sample
+        pathType: Exact
+        backend:
+          serviceName: %s
+          servicePort: %d
+`, backendSvc, backendPort[0])
+		err := s.CreateResourceFromString(ing)
+		assert.Nil(ginkgo.GinkgoT(), err, "creating ingress")
+		time.Sleep(5 * time.Second)
+
+		resp := s.NewAPISIXClient().GET("/sample").WithHeader("Host", "httpbin.org").Expect()
+		resp.Status(http.StatusMovedPermanently)
+		resp.Header("Location").Equal("https://httpbin.org/sample")
+	})
+})