<p>A typical ingress with TLS configuration is like below:</p>

<p><code>
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: no-rules-map
spec:
  tls:
  - secretName: testsecret
  backend:
    serviceName: s1
    servicePort: 80
</code></p>

<p>By default, the load balancer will talk to backend service in HTTP. Can I configure Ingress so that the communication between load balancer and the backend service is also HTTPS?</p>

<p>Update:</p>

<p>Found <a href="https://github.com/kubernetes/ingress-gce/blob/master/README.md" rel="noreferrer">GLBC</a> talking about enabling HTTPS backend for GCE Ingress. Excerpt from the document:</p>

<p>"Backend HTTPS</p>

<p>For encrypted communication between the load balancer and your Kubernetes service, you need to decorate the service's port as expecting HTTPS. There's an alpha Service annotation for specifying the expected protocol per service port. Upon seeing the protocol as HTTPS, the ingress controller will assemble a GCP L7 load balancer with an HTTPS backend-service with a HTTPS health check."</p>

<p>It is not clear if the load balancer accepts 3rd party signed server certificate, self-signed, or both. How CA cert should be configured on load balancer to do backend server authentication. Or it will bypass authentication check.</p>

<p>On <a href="https://github.com/kubernetes/ingress-nginx/" rel="noreferrer"><code>ingress-nginx</code></a> you can use the <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#backend-protocol" rel="noreferrer"><code>nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot; </code></a> annotation and point it to the HTTPS port on the service.</p>
<p>This is ingress controller specific and other ingress controllers might not provide the option (or provide an option that works differently)</p>
<p>With this setup, the ingress controller decrypts the traffic. (This allows the ingress controller to control things like ciphers and the certificate presented to the user and do path-based routing, which SSL passthrough does not allow)</p>
<p>It is possible to configure certificate validation with serveral other (<code>ingress-nginx</code>-specific) annotations:
<a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#backend-certificate-authentication" rel="noreferrer">Docs</a></p>
<ul>
<li>nginx.ingress.kubernetes.io/proxy-ssl-verify (it defaults to &quot;off&quot;)</li>
<li>nginx.ingress.kubernetes.io/proxy-ssl-verify-depth</li>
<li>nginx.ingress.kubernetes.io/proxy-ssl-ciphers (ciphers, not validation related)</li>
<li>nginx.ingress.kubernetes.io/proxy-ssl-name (Override the name that the cert is checked against)</li>
<li>nginx.ingress.kubernetes.io/proxy-ssl-protocols (SSL / TLS versions)</li>
<li>nginx.ingress.kubernetes.io/proxy-ssl-server-name (SNI passthrough)</li>
</ul>
