<p>I am doing some research on how to implement https secure connection between Nginx Ingress -&gt; backend services. So far I have SSL setup in Nginx Ingress controller that uses <code>Lets Encrypt</code> cert manager to rotate certificate using http-01 challenge.</p>
<p>Here is my scenario:</p>
<ol>
<li>Client from internet -&gt; 2. Load balancer -&gt; 3. Ingress Controller (that terminates TLS traffic) -&gt; 4. Service (port 80) -&gt; 5. Pod (port 80).</li>
</ol>
<p>So my question is how can I secure communication between ingress controller and pod so that traffic is encrypted end to end? Do I need my own certificate authority to do that? If so, are there any open source solution that can handle certificate management just like <a href="https://cert-manager.io/" rel="nofollow noreferrer">Cert manager</a>?</p>

<p><strong>1.</strong> Nginx ingress controller + <a href="https://github.com/dapr/dapr" rel="nofollow noreferrer">DAPR</a></p>
<p>I am not sure I can post here youtube urls(at least I have never seen anyone doing that) but.. I think this is 100% exactly what you want. Your scenario is discussed  in 1st topic, you need  watch only it. Plus as a benefit - you will see step-by-step installation there. Personally I found that video very helpful</p>
<p><a href="https://youtu.be/8W-iBDNvCUM?t=86" rel="nofollow noreferrer">Secure Ingress pods communication</a></p>
<p><strong>2.</strong> You can achieve that with Istio itself.
<a href="https://www.istiobyexample.dev/secure-ingress" rel="nofollow noreferrer">Istio By Example!:Secure Ingress</a></p>
<p><strong>3.</strong> Istio + Calico network policy for Istio</p>
<p><a href="https://docs.projectcalico.org/security/app-layer-policy" rel="nofollow noreferrer">Enforce network policy for Istio</a></p>
<p>The Calico support for Istio service mesh has the following benefits:</p>
<p><strong>-Pod traffic controls</strong></p>
<p>Lets you restrict ingress traffic inside and outside pods and mitigate common threats to Istio-enabled apps.</p>
<p><strong>-Supports security goals</strong></p>
<p>Enables adoption of a zero trust network model for security, including traffic encryption, multiple enforcement points, and multiple identity criteria for authentication.</p>
