Encrypt Traffic To HTTPS Load Balancers With TLS Certificates

#!/usr/bin/env bash
#
# Check ingress and service frontends for use of HTTPS/TLS
# Run on: any machine with kubectl access and context set to the target cluster

set -euo pipefail

echo "=== Cluster-wide TLS Frontend Report ==="
echo "Context: $(kubectl config current-context)"
echo

############################################
# 1. Ingress resources (networking.k8s.io)
############################################
echo ">>> Ingress resources (expect tls: configured and HTTPS rules in most cases)"
kubectl get ingress --all-namespaces -o json | jq -r '
  .items[] |
  {
    ns: .metadata.namespace,
    name: .metadata.name,
    class: (.spec.ingressClassName // "N/A"),
    tls_hosts: ([.spec.tls[].hosts[]] // []),
    rules: [.spec.rules[]? | {host, paths: [.http.paths[]? | {path, backend: .backend.service.name}]}]
  } |
  "NAMESPACE=\(.ns)\nNAME=\(.name)\nINGRESS_CLASS=\(.class)\nTLS_HOSTS=\(.tls_hosts|join(","))\nRULES=\(.rules)\n---"
'
echo

############################################
# 2. Services of type LoadBalancer
############################################
echo ">>> Services of type LoadBalancer (look for HTTPS ports and annotations)"
kubectl get svc --all-namespaces -o json | jq -r '
  .items[] |
  select(.spec.type == "LoadBalancer") |
  {
    ns: .metadata.namespace,
    name: .metadata.name,
    lb_ip: (.status.loadBalancer.ingress[0].ip // .status.loadBalancer.ingress[0].hostname // "pending"),
    ports: [.spec.ports[] | {name, port, targetPort, protocol}],
    annotations: (.metadata.annotations // {})
  } |
  "NAMESPACE=\(.ns)\nNAME=\(.name)\nEXTERNAL=\(.lb_ip)\nPORTS=\(.ports)\nANNOTATIONS=\(.annotations)\n---"
'
echo

############################################
# 3. IngressClasses (to infer controller / cloud LB type)
############################################
echo ">>> IngressClasses (to understand which controller / LB is used)"
kubectl get ingressclass -o wide || echo "No IngressClasses found"
echo

############################################
# 4. Optional: known TLS-related annotations per major cloud providers
############################################
echo ">>> Quick summary: LoadBalancer Services missing common TLS/HTTPS hints"
kubectl get svc --all-namespaces -o json | jq -r '
  .items[] |
  select(.spec.type == "LoadBalancer") |
  . as $svc |
  {
    ns: .metadata.namespace,
    name: .metadata.name,
    ports: [.spec.ports[] | {port, name}],
    annotations: (.metadata.annotations // {})
  } |
  . as $o |
  (
    # Heuristic: flag if any port is 80/http and no indication of HTTPS/SSL
    ([$o.ports[] | select((.port==80) or ((.name // "")|test("http";"i")))] | length) as $has_http
    |
    ([$o.ports[] | select((.port==443) or ((.name // "")|test("https|ssl|tls";"i")))] | length) as $has_https_port
    |
    ($o.annotations|tostring|test("tls|ssl|https";"i")) as $has_tls_ann
    |
    select($has_http == 1 and ($has_https_port == 0 and $has_tls_ann == false))
  ) |
  "POTENTIAL_ISSUE: NAMESPACE=\(.ns) NAME=\(.name) PORTS=\(.ports)"
'
echo
echo "=== Interpretation ==="
cat <<'EOF'
This script does NOT confirm cloud LB TLS configuration; review is manual:

Potential problems in the output:
- Ingress:
  - Ingress objects with no 'tls' section and rules that should be exposed securely.
  - IngressClass/controller that maps to HTTP-only or non-TLS-terminated frontends.
- LoadBalancer Services:
  - Services exposing port 80 / HTTP-only ports, with no corresponding 443/HTTPS port.
  - Services whose annotations do not indicate TLS/SSL configuration for the provider.
Next steps:
- For each flagged or suspicious resource, locate the corresponding load balancer
  in your cloud provider console/CLI and verify:
  - An HTTPS listener is configured.
  - A valid TLS certificate is attached.
  - HTTP (port 80) is either disabled or redirects to HTTPS.
EOF