<p>I'm doing SSL termination using Ingress for HTTPS traffic. But I also want to achieve the same thing for Custom Port (http virtual host). For example <code>https://example.com:1234</code> should go to <code>http://example.com:1234</code></p>
<p>Nginx Ingress has a <code>ConfigMap</code> where we can expose custom ports. But SSL termination doesn't work here.</p>
<p>Any work around? I wonder If I could redirect the incoming <code>https</code> using .htaccess instead.</p>
<pre><code>    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: tcp-services
      namespace: ingress-nginx
    data:
      1234: &quot;test-web-services/httpd:1234&quot;
---
apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
spec:
  externalTrafficPolicy: Local
  type: LoadBalancer
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: http
    - name: port-1234
      port: 1234
      protocol: TCP
      targetPort: 1234
</code></pre>

<p><code>SSL Termination</code> for TCP traffic is not a feature directly supported by <code>nginx-ingress</code>.</p>
<p>It is more widely described in this Github issue:</p>
<ul>
<li><em><a href="https://github.com/kubernetes/ingress-nginx/issues/636" rel="nofollow noreferrer">Github.com: Kubernetes: Ingress-nginx: Issues: [nginx] Support SSL for TCP
</a></em></li>
</ul>
<p>You can also find in this thread that some people were successful in implementing a workaround allowing them to support terminating <code>SSL</code> with <code>TCP</code> services. Specifically:</p>
<ul>
<li><em><a href="https://github.com/kubernetes/ingress-nginx/issues/636#issuecomment-749026036" rel="nofollow noreferrer">Github.com: Kubernetes: Ingress-nginx: Issues: [nginx] Support SSL for TCP: Comment 749026036</a></em></li>
</ul>
<hr />
<p>As your example featured the &quot;downgrade&quot; from <code>HTTPS</code> communication to <code>HTTP</code> it could be beneficiary to add that you can alter the way that <code>NGINX Ingress Controller</code> connects to your <code>backend</code>. Let me elaborate on that.</p>
<p>Please consider this as a workaround:</p>
<p>By default your <code>NGINX Ingress Controller</code> will connect to your backend with <code>HTTP</code>. This can be changed with following annotation:</p>
<ul>
<li><code>nginx.ingress.kubernetes.io/backend-protocol:</code></li>
</ul>
<p>Citing the official documentation:</p>
<blockquote>
<p>Using backend-protocol annotations is possible to indicate how NGINX should communicate with the backend service. (Replaces secure-backends in older versions) Valid Values: HTTP, HTTPS, GRPC, GRPCS, AJP and FCGI</p>
<p><strong>By default NGINX uses HTTP.</strong></p>
<p>-- <em><a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#backend-protocol" rel="nofollow noreferrer">Kubernetes.github.io: Ingress-nginx: User guide: Nginx configuration: Annotations: Backend protocol</a></em></p>
</blockquote>
<p>In this particular example the request path will be following:</p>
<ul>
<li><code>client</code> -- (HTTP<strong>S</strong>:443) --&gt; <code>Ingress controller</code> (TLS Termination) -- (HTTP:service-port) --&gt; <code>Service</code> ----&gt; <code>Pod</code></li>
</ul>
<hr />
<h3>The caveat</h3>
<p>You can use the <code>Service</code> of type <code>LoadBalancer</code> to send the traffic from port <code>1234</code> to either <code>80</code>/<code>443</code> of your <code>Ingress Controller</code>. This would make <code>TLS</code> termination much easier but it would force the client to use <strong>only one</strong> protocol. For example:</p>
<pre class="lang-yaml prettyprint-override"><code>    - name: custom
      port: 1234
      protocol: TCP
      targetPort: 443
</code></pre>
<p>This excerpt from <code>nginx-ingress</code> <code>Service</code> could be used to forward the <strong><code>HTTPS</code></strong> traffic to your <code>Ingress Controller</code> where the request would be <code>TLS terminated</code> and forwarded as <code>HTTP</code> to your <code>backend</code>. Forcing the <code>HTTP</code> through that port would yield error code <code>400: Bad request</code>.</p>
<p>In this particular example the request path will be following:</p>
<ul>
<li><code>client</code> -- (HTTP<strong>S</strong>:1234) --&gt; <code>Ingress controller</code> (TLS Termination) -- (HTTP:service-port) --&gt; <code>Service</code> ----&gt; <code>Pod</code></li>
</ul>
