fix: Agent 405 errors when reverse proxy redirects HTTP to HTTPS

When a user's reverse proxy redirects HTTP to HTTPS, Go's default HTTP
client behavior converts POST requests to GET on 301/302 redirects
(per HTTP specification). This causes the Pulse server to return 405
"Only POST is allowed" errors.

Added CheckRedirect to all agent HTTP clients (host, docker, kubernetes)
that returns a clear error message guiding users to use the correct
protocol in their --url flag instead of silently following redirects.

Related to #1058

internal/dockeragent/agent.go

@@ -999,6 +999,12 @@ func newHTTPClient(insecure bool) *http.Client {
 		Transport: &http.Transport{
 			TLSClientConfig: tlsConfig,
 		},
+		// Disallow redirects for agent API calls. If a reverse proxy redirects
+		// HTTP to HTTPS, Go's default behavior converts POST to GET (per HTTP spec),
+		// causing 405 errors. Return an error with guidance instead.
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return fmt.Errorf("server returned redirect to %s - if using a reverse proxy, ensure you use the correct protocol (https:// instead of http://) in your --url flag", req.URL)
+		},
 	}
 }
 

internal/hostagent/agent.go

@@ -184,6 +184,12 @@ func New(cfg Config) (*Agent, error) {
 			Proxy:           http.ProxyFromEnvironment,
 			TLSClientConfig: tlsConfig,
 		},
+		// Disallow redirects for agent API calls. If a reverse proxy redirects
+		// HTTP to HTTPS, Go's default behavior converts POST to GET (per HTTP spec),
+		// causing 405 errors. Return an error with guidance instead.
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return fmt.Errorf("server returned redirect to %s - if using a reverse proxy, ensure you use the correct protocol (https:// instead of http://) in your --url flag", req.URL)
+		},
 	}
 
 	trimmedTags := make([]string, 0, len(cfg.Tags))

internal/kubernetesagent/agent.go

@@ -139,6 +139,12 @@ func New(cfg Config) (*Agent, error) {
 			Proxy:           http.ProxyFromEnvironment,
 			TLSClientConfig: tlsConfig,
 		},
+		// Disallow redirects for agent API calls. If a reverse proxy redirects
+		// HTTP to HTTPS, Go's default behavior converts POST to GET (per HTTP spec),
+		// causing 405 errors. Return an error with guidance instead.
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return fmt.Errorf("server returned redirect to %s - if using a reverse proxy, ensure you use the correct protocol (https:// instead of http://) in your --url flag", req.URL)
+		},
 	}
 
 	clusterServer := strings.TrimSpace(restCfg.Host)