I have an ingress that connects to Kubernetes Dashboard, but I'm getting a 400 error when trying to access it.

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/auth-tls-verify-client: "false"
    nginx.ingress.kubernetes.io/whitelist-source-range: ""
    - hosts:
        - kube.example.com
      secretName: dashboard-tls  # confirmed is valid LE cert
    - host: kube.example.com
          - backend:
              serviceName: kubernetes-dashboard
              servicePort: 443

That gives me a 400 error in the nginx pod.

2020/08/28 01:25:58 [error] 2609#2609: *795 readv() failed (104: Connection reset by peer) while reading upstream, client:, server: kube.example.com, request: "GET / HTTP/1.1", upstream: "", host: "kube.example.com" - - [28/Aug/2020:01:25:58 +0000] "GET / HTTP/1.1" 400 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0" "-"


And in case it is relevant, my nginx configuration, deployed through the helm chart nginx-stable/nginx-ingress

  ## nginx configuration
  ## Ref: https://github.com/kubernetes/ingress/blob/master/controllers/nginx/configuration.md
        hsts-include-subdomains: "false"
        ssl-protocols: "TLSv1.1 TLSv1.2"
    ingressClass: nginx
      externalTrafficPolicy: Local
        metallb.universe.tf/address-pool: default
    enabled: true
    22: "gitlab/gitlab-gitlab-shell:22"
  • Seems like you're trying to use HTTP to access an HTTPS endpoint.
    – Spooler
    Aug 28, 2020 at 2:14
  • @Spooler but doesn't backend-protocol=HTTPS make it use HTTPS instead?
    – cclloyd
    Aug 28, 2020 at 2:18
  • That makes the reverse proxy communicate with the backend services via https, but the client initiating requests to the ingress controller must not use 'http', or it will be classified as an invalid request. You have not defined a redirect from http to https.
    – Spooler
    Aug 28, 2020 at 2:26
  • @Spooler I removed the ssl-redirect annotation because the docs stated that it's on by default if https is available. But even adding it back and setting it to true, and doing curl https://kube.example.com returns Client sent an HTTP request to an HTTPS server.
    – cclloyd
    Aug 28, 2020 at 2:31

1 Answer 1


All you need is this annotation on your service ingress

    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/configuration-snippet: |-
      proxy_ssl_server_name on;
      proxy_ssl_name $host;
  • You saved my life (: Feb 13, 2021 at 19:09
  • I had to use this syntax, kubernetes.github.io/ingress-nginx/user-guide/…
    – oxr463
    Mar 9, 2021 at 22:06
  • 1
    OMG - you saved my life too. Though it seems I just needed to use the first annotation backend-protocol. What additional stuff does the configuration-snippet enable?
    – AnthonyK
    Apr 10, 2021 at 15:07
  • 1
    This solved my problem too, but besides the configuration snippet, an explanation of what is going on would be needed for the answer to be complete.
    – istepaniuk
    Sep 11, 2021 at 22:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.