<p>I am running a local deployment and trying to redirect HTTPS traffic to my backend pods.
I don't want SSL termination at the Ingress level, which is why I didn't use any tls secrets.</p>
<p>I am creating a self signed cert within the container, and Tomcat starts up by picking that and exposing on 8443.</p>
<p>Here is my Ingress Spec</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-name
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    nginx.ingress.kubernetes.io/ssl-passthrough: &quot;true&quot;
    nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
    nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
    #nginx.ingress.kubernetes.io/service-upstream: &quot;false&quot;
    kubernetes.io/ingress.class: {{ .Values.global.ingressClass }}
    nginx.ingress.kubernetes.io/affinity: &quot;cookie&quot;
spec:
  rules:
  - http:
      paths:
        - path: /myserver
          backend:
            serviceName: myserver
            servicePort: 8443
</code></pre>
<p>I used the above annotation in different combinations but I still can't reach my pod.</p>
<p>My service routes</p>
<pre><code># service information for myserver
service:
  type: ClusterIP
  port: 8443
  targetPort: 8443
  protocol: TCP
</code></pre>
<p>I did see a few answers regarding this suggesting annotations, but that didn't seem to work for me. Thanks in advance!</p>
<p>edit: The only thing that remotely worked was when I overwrote the ingress values as</p>
<pre><code>nginx-ingress:
  controller:
    publishService:
      enabled: true
    service:
      type: NodePort
      nodePorts:
        https: &quot;40000&quot;
</code></pre>
<p>This does enable https, but it picks up kubernetes' fake certs, rather than my cert from the container</p>
<p>Edit 2:
For some reason, the ssl-passthrough is not working. I enforced it as</p>
<pre><code>nginx-ingress:
  controller:
    extraArgs:
      enable-ssl-passthrough: &quot;&quot;
</code></pre>
<p>when I describe the deployment, I can see it in the args but when I check with <code>kubectl ingress-nginx backends</code> as described in <a href="https://kubernetes.github.io/ingress-nginx/kubectl-plugin/#backends" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/kubectl-plugin/#backends</a>, it says &quot;sslPassThrough:false&quot;</p>

<p>There are several thingns you need to setup if you want to use ssl-passthrough.</p>
<ol>
<li><p>First is to set proper host name:</p>
<pre><code>spec:
  rules:
  - host: example.com    &lt;- HERE
    http:
      ...
</code></pre>
<p>It's mentioned <a href="https://kubernetes.github.io/ingress-nginx/user-guide/tls/#ssl-passthrough" rel="nofollow noreferrer">in documentation</a>:</p>
<blockquote>
<p>SSL Passthrough leverages SNI [Server Name Indication] and reads the virtual domain from the
TLS negotiation, which requires compatible clients. After a connection
has been accepted by the TLS listener, it is handled by the controller
itself and piped back and forth between the backend and the client.</p>
<p>If there is no hostname matching the requested host name, the request
is handed over to NGINX on the configured passthrough proxy port
(default: 442), which proxies the request to the default backend.</p>
</blockquote>
</li>
</ol>
<hr />
<ol start="2">
<li><p>Second thing is setting <code>--enable-ssl-passthrough</code> flag as already mentioned in separate answer by @thomas.</p>
<p>Just edit the nginx ingress deployment and add this line to args list:</p>
<pre><code> - --enable-ssl-passthrough
</code></pre>
</li>
</ol>
<hr />
<ol start="3">
<li><p>Third thing that has to be done is use to use the following annotations in your ingress object definition:</p>
<pre><code> nginx.ingress.kubernetes.io/ssl-passthrough: &quot;true&quot;
 nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
</code></pre>
</li>
</ol>
<p>IMPORTANT: <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#ssl-passthrough" rel="nofollow noreferrer">In docs</a> you can read:</p>
<blockquote>
<p>Attention</p>
<p>Because SSL Passthrough works on layer 4 of the OSI model (TCP) and
not on the layer 7 (HTTP), using SSL Passthrough invalidates all the
other annotations set on an Ingress object.</p>
</blockquote>
<p>This means that all other annotations are useless from now on. This applies to annotations like <code>force-ssl-redirect</code>, <code>affinity</code> and also to paths you defined (e.g. <code>path: /myserver</code>). Since traffic is end-to-end encrypted, all ingress sees is some gibberish and all it can do is pass this data to the application based on dns name (SNI).</p>
