<p>I want to allow traffic to look like the following:</p>
<p>external client https request (e.g. <a href="https://my-app-out-side-cluster.com" rel="nofollow noreferrer">https://my-app-out-side-cluster.com</a>) -&gt; inside the cluster (terminate tls) and change to http (e.g. <a href="http://my-app-out-side-cluster.com" rel="nofollow noreferrer">http://my-app-out-side-cluster.com</a>) -&gt; service outside the cluster</p>
<p>I have followed <a href="https://stackoverflow.com/questions/57764237/kubernetes-ingress-to-external-service">this</a> post to configure my Ingress and External traffic, however, since my service outside the cluster is http, I get an SSL error when making a request with https. Changing the request to http works, however, this is not desired.</p>
<p>My question is, is there a way to</p>
<ol>
<li>Terminate SSL in the Ingress (using the ingress controller)</li>
<li>Redirect traffic to the service outside the cluster listening on http ?</li>
</ol>
<pre><code>---
kind: Service
apiVersion: v1
metadata:
  name: my-external-service
spec:
  type: ExternalName
  externalName: my-app-out-side-cluster.com
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: kong
spec:
  controller: ingress-controllers.konghq.com/kong
---
kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: my-ingress
  namespace: kong
  annotations:
    konghq.com/protocols: &quot;https&quot;
spec:
  ingressClassName: kong
  tls:
  - secretName: my-secret
    hosts:
    - my-app-out-side-cluster.com
  rules:
  - host: my-app-out-side-cluster.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: my-external-service
            port:
              number: 80
</code></pre>

<p>i am not sure how your setup and K8s cluster is set,</p>
<p>is it a <strong>private</strong> cluster or <strong>public</strong> cluster, how the request is getting outside of POD running any service of Node or Java that calling HTTP service?</p>
<blockquote>
<p>external client https request (e.g.
<a href="https://my-app-out-side-cluster.com" rel="nofollow noreferrer">https://my-app-out-side-cluster.com</a>) -&gt; inside the cluster</p>
</blockquote>
<p>For this you are on rigth path. You have to setup the ingress controller which will handle the incoming request and do the TLS termination.</p>
<p>Your TLS/SSL cert will be stored inside the secret of the Kubernetes and will get attached to ingress.</p>
<p>Ingress will allow the HTTPS traffic and will do the <strong>TLS</strong> termination so in background it will forward the plain <strong>http</strong> traffic.</p>
<p>Reference article : <a href="https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes" rel="nofollow noreferrer">https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes</a></p>
<p>If you are on <strong>AWS</strong> : <a href="https://aws.amazon.com/premiumsupport/knowledge-center/terminate-https-traffic-eks-acm/" rel="nofollow noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/terminate-https-traffic-eks-acm/</a></p>
<blockquote>
<p>change to http (e.g. <a href="http://my-app-out-side-cluster.com" rel="nofollow noreferrer">http://my-app-out-side-cluster.com</a>) -&gt; service
outside the cluster</p>
</blockquote>
<p>i think this endpoint might be getting called of service running inside the pod, so in that, you can change the HTTP simply and it will work.</p>
<p>In your K8s cluster depending on CNI plugin your traffic route, ideally, POD gets scheduled on Node and it will send a request directly from there.</p>
<p>Your request doesn't go outside of through the Nginx ingress controller unless it's the <strong>response</strong>.</p>
