<p>I'm attempting to configure AKS, and I have the below setup</p>
<p><a href="https://i.stack.imgur.com/n6FfO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/n6FfO.png" alt="enter image description here" /></a></p>
<p>I want to enable HTTPS between Nginx Kubernetes Ingress Controller &amp; Asp.Net Core 6.0 WebAPI PODs, like</p>
<p><a href="https://i.stack.imgur.com/XGalr.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/XGalr.png" alt="enter image description here" /></a></p>
<p>How do I setup this? Where do I store the WebAPI SSL certificate?</p>

<p>Reference <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#backend-protocol" rel="nofollow noreferrer">documentation for annotation</a> to set the ingress backend to <code>HTTPS</code>:</p>
<pre><code>nginx.ingress.kubernetes.io/backend-protocol: HTTPS
</code></pre>
<p>Follow the guidance <a href="https://learn.microsoft.com/en-us/aspnet/core/security/docker-https?view=aspnetcore-6.0" rel="nofollow noreferrer">here</a> to setup SSL certs for your WebAPI pods.</p>
<p>The certs can be stored in kubernetes generic <code>secret</code> and can be mounted onto the pods as <code>volumes</code>. In production, the AKS secret storage could be <a href="https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver" rel="nofollow noreferrer">backed by Azure KeyVault</a>, so the cert would be really stored in the KeyVault.</p>
<p>For your test environment, here is how you create secret:</p>
<pre><code>kubectl create secret generic webapi-cert-secret 
  --from-file=cert=yourcert.pfx
  --from-literal=pass='yourcertpasswd'
</code></pre>
<p>Then mount into your pod/deployment definition (truncated for brevity):</p>
<pre><code>      env:
      - name: Kestrel__Certificates__Default__Path
        value: /certs/aspnet-cert.pfx
      - name: Kestrel__Certificates__Default__Password
        valueFrom:
          secretKeyRef:
            name: webapi-cert-secret
            key: pass
      volumeMounts:
      - name: certsvolume
        mountPath: /certs/aspnet-cert.pfx
        subPath: aspnet-cert.pfx
        readOnly: true
  volumes:
  - name: certsvolume
    secret:
      secretName: webapi-cert-secret
      items:
      - key: cert
        path: aspnet-cert.pfx
</code></pre>
