<p>I am trying to do tls termination at pod level.
ingress(nlb) --&gt;service(clusterip) --&gt; pod</p>
<p>I have set ingress with ssl passthrough by adding the following annotations,</p>
<pre><code>annotations:
  nginx.ingress.kubernetes.io/backend-protocol: &quot;HTTPS&quot;
  nginx.ingress.kubernetes.io/ssl-passthrough: &quot;true&quot;
  nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
</code></pre>
<p>After this, I am not sure what needs to be done at pod to terminate tls. I am unable to find any document related to this. Is mTLS the only solution? I need to do tls termination for only 2 pods that are running in the namespace.</p>
<p>I tried below configuration. It is not working.
Am I missing anything?</p>
<p>nginx ingress controller:</p>
<pre><code>enabled ssl-passthrough 
</code></pre>
<p>Ingress annotations:</p>
<pre><code>   nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
    nginx.ingress.kubernetes.io/ssl-passthrough: &quot;true&quot;
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
</code></pre>
<p>Ingress spec:</p>
<pre><code>spec:
  rules:
  - host: xyz.test.com
    http:
      paths:
      - backend:
          service:
            name: xyz
            port:
              number: 443
        path: /
        pathType: Prefix
</code></pre>
<p>Service -  ports section in spec:</p>
<pre><code>  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: 1443
</code></pre>
<p>nginx sidecar container in app pod:
ports:
- containerPort: 1443
name: https
protocol: TCP</p>
<pre><code>volumeMounts:
        - name: secret
          mountPath: /etc/nginx/ssl
          readOnly: true

  volumes:
  - name: secret
    secret:
      secretName: xyz-tls 
</code></pre>
<p>I could exec into the pod and see that the certificates and key files are present in /etc/nginx/ssl</p>
<p>I also updated /etc/nginx/conf.d with following changes:</p>
<pre><code>server {
  listen 1443 default_server ssl;
  listen [::]:1443 default_server ipv6only=on;
  ssl_certificate /etc/nginx/ssl/tls.crt;
  ssl_certificate_key /etc/nginx/ssl/tls.key;
.....
</code></pre>

<p>My advice: don't do it! You don't want to have to deal with certs inside your pods. Get the TLS done on your load balancers, managed by your cloud provider, or managed in your cluster by <code>cert-manager</code> and a proper cert provider (like Let's Encrypt)</p>
<p>If you really want to terminate TLS in your pod, then use TCP as the protocol, and that will let encrypted messages through.</p>
