<p>I have recently been using the nginxdemo/nginx-ingress controller.</p>

<p>As I understand it this controller cannot do SSL Passthrough (by that I mean pass the client certificate all the way through to the backend service for authentication), so instead I have been passing the clients subject DN through a header.</p>

<p>Ultimately I would prefer SSL-Passthrough and have been looking at the kubernetes/ingress-nginx project which apparently supports SSL passthrough.</p>

<p>Does anyone have an experience with this controller and SSL Passthrough.</p>

<p>The few Ingress examples showing passthrough that I have found leave the path setting blank.</p>

<p>Is this because passthrough has to take place at the TCP level (4) rather then at HTTP (7)?</p>

<p>Right now, I have a single host rule that services mutiple paths.</p>

<p>completing on lch answer I would like to add that I had the same problem recently and I sorted it out modifiying the ingress-service deployment (I know, it should be a DaemonSet but that's a different story)</p>

<p>The change was adding the parameter to spec.containers.args:</p>

<pre><code>  --enable-ssl-passthrough                                        
</code></pre>

<p>Then I've added the following annotations to my ingress:</p>

<pre><code>kubernetes.io/ingress.allow-http: "false"
nginx.ingress.kubernetes.io/secure-backends: "true"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
</code></pre>

<p>The important one are secure-backends and ssl-passthrough but I think the rest are a good idea, provided you're not expecting http traffic there</p>
