redirect with 308 following nginx default

Signed-off-by: omar <omar.hammami@solo.io>

Author: puertomontt

pkg/i2gw/implementations/kgateway/README.md

@@ -59,8 +59,8 @@ The command should generate Gateway API and Kgateway resources.
 - `nginx.ingress.kubernetes.io/limit-burst-multiplier`
 - `nginx.ingress.kubernetes.io/proxy-send-timeout`
 - `nginx.ingress.kubernetes.io/proxy-read-timeout`
-- `nginx.ingress.kubernetes.io/ssl-redirect`: When set to `"true"`, adds a `RequestRedirect` filter to HTTPRoute rules that redirects HTTP to HTTPS with a 301 status code.
-- `nginx.ingress.kubernetes.io/force-ssl-redirect`: When set to `"true"`, adds a `RequestRedirect` filter to HTTPRoute rules that redirects HTTP to HTTPS with a 301 status code. Treated identically to `ssl-redirect`.
+- `nginx.ingress.kubernetes.io/ssl-redirect`: When set to `"true"`, adds a `RequestRedirect` filter to HTTPRoute rules that redirects HTTP to HTTPS with a 308 status code.
+- `nginx.ingress.kubernetes.io/force-ssl-redirect`: When set to `"true"`, adds a `RequestRedirect` filter to HTTPRoute rules that redirects HTTP to HTTPS with a 308 status code. Treated identically to `ssl-redirect`.
 - `nginx.ingress.kubernetes.io/ssl-passthrough`: When set to `"true"`, enables TLS passthrough mode. Converts the Ingress to a `TLSRoute` with a Gateway listener using `protocol: TLS` and `tls.mode: Passthrough`. The HTTPRoute that would normally be created is removed.
 - `nginx.ingress.kubernetes.io/use-regex`: When set to `"true"`, indicates that the paths defined on an Ingress should be treated as regular expressions.
   Uses host-group semantics: if any Ingress contributing rules for a given host has `use-regex: "true"`, regex-style path matching is enforced on **all**

pkg/i2gw/implementations/kgateway/ssl_redirect.go

@@ -118,7 +118,7 @@ func splitHTTPRouteForSSLRedirect(
 					Type: gwv1.HTTPRouteFilterRequestRedirect,
 					RequestRedirect: &gwv1.HTTPRequestRedirectFilter{
 						Scheme:     ptr.To("https"),
-						StatusCode: ptr.To(301),
+						StatusCode: ptr.To(308),
 					},
 				},
 			)

pkg/i2gw/implementations/kgateway/testing/testdata/output/ssl_redirect.yaml

@@ -56,7 +56,7 @@ spec:
     - filters:
         - requestRedirect:
             scheme: https
-            statusCode: 301
+            statusCode: 308
           type: RequestRedirect
       matches:
         - path:
@@ -106,7 +106,7 @@ spec:
     - filters:
         - requestRedirect:
             scheme: https
-            statusCode: 301
+            statusCode: 308
           type: RequestRedirect
       matches:
         - path:
@@ -115,7 +115,7 @@ spec:
     - filters:
         - requestRedirect:
             scheme: https
-            statusCode: 301
+            statusCode: 308
           type: RequestRedirect
       matches:
         - path:
@@ -124,7 +124,7 @@ spec:
     - filters:
         - requestRedirect:
             scheme: https
-            statusCode: 301
+            statusCode: 308
           type: RequestRedirect
       matches:
         - path:

pkg/i2gw/providers/ingressnginx/README.md

@@ -132,9 +132,9 @@ The ingress-nginx provider currently supports translating the following annotati
 
 ### SSL Redirect
 
-- `nginx.ingress.kubernetes.io/ssl-redirect`: When set to `"true"`, enables SSL redirect for HTTP requests. For the Kgateway implementation, this maps to a `RequestRedirect` filter on HTTPRoute rules that redirects HTTP to HTTPS with a 301 status code.
+- `nginx.ingress.kubernetes.io/ssl-redirect`: When set to `"true"`, enables SSL redirect for HTTP requests. For the Kgateway implementation, this maps to a `RequestRedirect` filter on HTTPRoute rules that redirects HTTP to HTTPS with a 308 status code.
 
-- `nginx.ingress.kubernetes.io/force-ssl-redirect`: When set to `"true"`, enables SSL redirect for HTTP requests. This annotation is treated exactly the same as `ssl-redirect`. For the Kgateway implementation, this maps to a `RequestRedirect` filter on HTTPRoute rules that redirects HTTP to HTTPS with a 301 status code.
+- `nginx.ingress.kubernetes.io/force-ssl-redirect`: When set to `"true"`, enables SSL redirect for HTTP requests. This annotation is treated exactly the same as `ssl-redirect`. For the Kgateway implementation, this maps to a `RequestRedirect` filter on HTTPRoute rules that redirects HTTP to HTTPS with a 308 status code.
 
 **Note:** Both annotations are supported and treated identically. If either annotation is set to `"true"` (case-insensitive), SSL redirect will be enabled. The redirect filter is added at the rule level in the HTTPRoute, redirecting all HTTP traffic to HTTPS.