<p>Ingress controller deployment.yml</p>
<pre><code>    spec:
  containers:
    - args:
        - /nginx-ingress-controller
        - --default-backend-service=stratus/nginx-ingress-default-backend
        - --election-id=ingress-controller-leader
        - --ingress-class=nginx
        - --configmap=ingress-controller-leader-nginx
        - --enable-ssl-passthrough
</code></pre>
<p>Ingress resource.yml</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: 'REPOSITORY_NAME'
  namespace: service
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    nginx.ingress.kubernetes.io/ssl-passthrough: &quot;false&quot;
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
spec:
  tls:
    - hosts:
        - &quot;xyz-development.com&quot;
    - secretName: ingress-secret-tls
  rules:
    - host: &quot;xyz-development.com&quot; 
      http:
        paths:
        - path: /service/
          backend:
            serviceName: 'REPOSITORY_NAME'
            servicePort: 8080
</code></pre>
<p>the secret consists of a signed certificate with the CN as xyz-development.com</p>
<p>endpoint : xyz-development.com/service/swagger-ui.html</p>
<p>If I try to access the endpoint with the above config, I end up with &quot;Your connection is not private&quot; error.</p>
<p>But if I modify the ingress controller deployment.yml to</p>
<pre><code>    spec:
  containers:
    - args:
        - /nginx-ingress-controller
        - --default-backend-service=stratus/nginx-ingress-default-backend
        - --election-id=ingress-controller-leader
        - --ingress-class=nginx
        - --configmap=stratus/ingress-controller-leader-nginx
        - --enable-ssl-passthrough
        - --default-ssl-certificate=service/ingress-secret-tls
</code></pre>
<p>Then the site is secure with my valid certificate.</p>
<ol>
<li>Is this expected behaviour?</li>
<li>Even if the default ssl certificate flag is removed in the controller, shouldn't the secret mentioned in the ingress resource.yml be used?</li>
<li>Any other pointers or better practice would be appreciated</li>
</ol>

<p>There's a minor typo in your manifest that's causing the first option to fail; it should <strong>not</strong> be a new element in the array of <code>.spec.tls</code> entries:</p>
<pre><code>- secretName: ingress-secret-tls # wrong
  secretName: ingress-secret-tls # correct
</code></pre>
