<p>I have a backend using https.
I want to separate load on that back-end based on URL/path.</p>

<p>I decided to use ingress to do this url/path based logic in order to move traffic to different back-ends ( same back-ends , just duplicated to different NodePorts )</p>

<p>my question is how I can configure the ingress to receive https requests and to forward those https requests to the https back-end?</p>

<p>thanks</p>

<p>edit:
I added the yaml file:</p>

<pre><code>spec:
  rules:
  - http:
      paths:
      - backend:
          serviceName: service
          servicePort: 9443
        path: /carbon
      - backend:
          serviceName: service2
          servicePort: 9443
        path: /oauth
</code></pre>

<p>for some reason I can;t change the rule form http to https</p>

<p><strong>Attention:</strong> This answer applies to the ingress-nginx solution provided by the kubernetes organisation on github (<a href="https://github.com/kubernetes/ingress-nginx" rel="noreferrer">https://github.com/kubernetes/ingress-nginx</a>)</p>
<hr />
<p>If you want to use load balancing mechanisms in k8s you should use <a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="noreferrer">services</a> instead and start multiple instances behind that service that way k8s will do the load balancing. If you want to use different versions of your backend (e.g. prod and test) your way of separating them is fine</p>
<p>if your service is only reachable via https you need to add the following annotation to your ingress yaml: (<a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#backend-protocol" rel="noreferrer">documentation</a>)</p>
<pre><code>nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
</code></pre>
<p>To secure ingress itself  take a look at this: <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#tls" rel="noreferrer">https://kubernetes.io/docs/concepts/services-networking/ingress/#tls</a></p>
<p>But if you want that the backend services decrypt the TLS communication use the following annotation instead: (<a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#ssl-passthrough" rel="noreferrer">documentation</a>)</p>
<pre><code>nginx.ingress.kubernetes.io/ssl-passthrough: &quot;true&quot;
</code></pre>
<p><strong>Edit:</strong></p>
<p>The Ingress YAML should look like this if you want to reach the backend via TLS:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-name
  namespace: namespace-name 
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
spec:
  rules:
  - http:
      paths:
      - backend:
          serviceName: service
          servicePort: 9443
        path: /carbon
      - backend:
          serviceName: service2
          servicePort: 9443
        path: /oauth
</code></pre>
<p>The Ingress YAML should look like this if you want to reach the backend via TLS with TLS decryption in the ingress controller:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-name
  namespace: namespace-name 
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
spec:
  tls:
  - hosts:
    - app.myorg.com
    secretName: tls-secret 
  rules:
  - http:
      paths:
      - backend:
          serviceName: service
          servicePort: 9443
        path: /carbon
      - backend:
          serviceName: service2
          servicePort: 9443
        path: /oauth
</code></pre>
<p>It's important to note that tls-secret is the name of a SecretConfig with a valid Certificate issued for the host (app.myorg.com)</p>
<hr />
<p>The Ingress YAML should look like this if you want to reach the backend via TLS with TLS decryption in the backend:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-name
  namespace: namespace-name 
  annotations:
    nginx.ingress.kubernetes.io/ssl-passthrough: &quot;true&quot;
spec:
  rules:
  - http:
      paths:
      - backend:
          serviceName: service
          servicePort: 9443
        path: /carbon
      - backend:
          serviceName: service2
          servicePort: 9443
        path: /oauth
</code></pre>
<p>I never tested the last version myself so i don't know if that actually works but I'd strongly advise reading <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#ssl-passthrough" rel="noreferrer">this</a> passage for that variant.</p>
