Ambassador does not redirect plaintext websocket to secure websocket during handshake

Describe the bug I have a backend service that exposes an HTTP API and a real time websocket endpoint. I recently went through the process of ensuring the HTTP endpoint is always communicated with over HTTPS by setting up Ambassadors HTTP -> HTTPS redirection.

Websockets start their life as an HTTP GET request with some specialized headers. I was expecting that Ambassador would just do the right thing and redirect the incoming request to the HTTPS endpoint. Instead Ambassador sent back a HTTP 403 Forbidden.

To Reproduce

1. Setup a websocket backend.
2. Setup TLS
3. I used the below mapping:

      ---
      apiVersion: ambassador/v0
      kind: Mapping
      ambassador_id: {{ service.ambassador.id }}
      name: kubernaut-public-ws-hostroute
      prefix: /ws
      rewrite: /ws
      host: ^next\.kubernaut\.io(:443)?$
      host_regex: true
      use_websocket: true
      service: kubernaut-public

1. I used the following Ambassador config:

      ---
      apiVersion: ambassador/v0
      kind: Module
      name: ambassador
      ambassador_id: "{{ service.ambassador.id }}"
      config:
        use_proxy_proto: false
        use_remote_address: true

      ---
      apiVersion: ambassador/v0
      kind: Module
      name: tls
      ambassador_id: "{{ service.ambassador.id }}"
      config:
        server:
          enabled: true
          secret: "ambassador-{{ service.ambassador.id }}-certs"
          redirect_cleartext_from: 80
        client:
          enabled: false

1. Send a cURL request to inititate the handshake:

curl --include \
                             --no-buffer \
                             --header "Connection: Upgrade" \
                             --header "Upgrade: websocket" \
                             --header "Host: next.kubernaut.io" \
                             --header "Sec-WebSocket-Key: SGVsbG8sIHdvcmxkIQ==" \
                             --header "Sec-WebSocket-Version: 13" \
                             -k -L -v \
                        "http://next.kubernaut.io/ws/kapv1?agent-id=e7430ca7-fef8-48cf-b400-265c89e1c931"
*   Trying 35.225.224.51...
* TCP_NODELAY set
* Connected to next.kubernaut.io (35.225.224.51) port 80 (#0)
> GET /ws/kapv1?agent-id=e7430ca7-fef8-48cf-b400-265c89e1c931 HTTP/1.1
> Host: next.kubernaut.io
> User-Agent: curl/7.55.1
> Accept: */*
> Connection: Upgrade
> Upgrade: websocket
> Sec-WebSocket-Key: SGVsbG8sIHdvcmxkIQ==
> Sec-WebSocket-Version: 13
> 
< HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
< date: Fri, 03 Aug 2018 14:19:33 GMT
date: Fri, 03 Aug 2018 14:19:33 GMT
< server: envoy
server: envoy
< content-length: 0
content-length: 0

< 
* Connection #0 to host next.kubernaut.io left intact

Expected behavior

• Expected an HTTPS redirect.

Additional context Add any other context about the problem here.

[richarddli]

0.52 is pretty old; I’m pretty sure this was fixed subsequent to that. Please upgrade and try your issue.

[treethought]

experiencing the same issue. seems dupe of #2911