<p>I am running a local deployment and trying to redirect HTTPS traffic to my backend pods.
I don't want SSL termination at the Ingress level, which is why I didn't use any tls secrets.</p>
<p>I am creating a self signed cert within the container, and Tomcat starts up by picking that and exposing on 8443.</p>
<p>Here is my Ingress Spec</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-name
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    nginx.ingress.kubernetes.io/ssl-passthrough: &quot;true&quot;
    nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
    nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
    #nginx.ingress.kubernetes.io/service-upstream: &quot;false&quot;
    kubernetes.io/ingress.class: {{ .Values.global.ingressClass }}
    nginx.ingress.kubernetes.io/affinity: &quot;cookie&quot;
spec:
  rules:
  - http:
      paths:
        - path: /myserver
          backend:
            serviceName: myserver
            servicePort: 8443
</code></pre>
<p>I used the above annotation in different combinations but I still can't reach my pod.</p>
<p>My service routes</p>
<pre><code># service information for myserver
service:
  type: ClusterIP
  port: 8443
  targetPort: 8443
  protocol: TCP
</code></pre>
<p>I did see a few answers regarding this suggesting annotations, but that didn't seem to work for me. Thanks in advance!</p>
<p>edit: The only thing that remotely worked was when I overwrote the ingress values as</p>
<pre><code>nginx-ingress:
  controller:
    publishService:
      enabled: true
    service:
      type: NodePort
      nodePorts:
        https: &quot;40000&quot;
</code></pre>
<p>This does enable https, but it picks up kubernetes' fake certs, rather than my cert from the container</p>
<p>Edit 2:
For some reason, the ssl-passthrough is not working. I enforced it as</p>
<pre><code>nginx-ingress:
  controller:
    extraArgs:
      enable-ssl-passthrough: &quot;&quot;
</code></pre>
<p>when I describe the deployment, I can see it in the args but when I check with <code>kubectl ingress-nginx backends</code> as described in <a href="https://kubernetes.github.io/ingress-nginx/kubectl-plugin/#backends" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/kubectl-plugin/#backends</a>, it says &quot;sslPassThrough:false&quot;</p>

<p>SSL Passthrough requires a specific flag to be passed to the nginx controller while starting since it is disabled by default.</p>
<blockquote>
<p>SSL Passthrough is <strong>disabled by default</strong> and requires starting the controller with the <a href="https://kubernetes.github.io/ingress-nginx/user-guide/cli-arguments/" rel="nofollow noreferrer"><code>--enable-ssl-passthrough</code></a> flag.</p>
</blockquote>
<p>Since <code>ssl-passthrough</code> works on layer 4 of the OSI model and not on the layer 7 (HTTP) using it will invalidate all the other annotations that you set on the ingress object.</p>
<p>So at your deployment level you have specify this flag under <code>args</code>:</p>
<pre><code>containers:
        - name: controller
          image: us.gcr.io/k8s-artifacts-prod/ingress-nginx/controller:v0.34.1@sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
          imagePullPolicy: IfNotPresent
          lifecycle:
            preStop:
              exec:
                command:
                  - /wait-shutdown
          args:
            - /nginx-ingress-controller
            - --enable-ssl-passthrough
</code></pre>
