<p>In Kubernetes, to enable client-certificate authN, the annotation nginx.ingress.kubernetes.io/auth-tls-verify-client can be used in an ingress. Will client-cert authN work even if I don't do TLS termination in that ingress? For instance, in this <a href="https://kubernetes.github.io/ingress-nginx/examples/auth/client-certs/ingress.yaml" rel="nofollow noreferrer">ingress</a>, will client-cert authN still work if I remove the tls block from the ingress?</p>
<pre><code>tls:
  - hosts:
    - mydomain.com
    secretName: tls-secret
</code></pre>
<p>(More info: I have two ingresses for the same host, one which has a TLS section, and another ingress which has rule for a specific api-path, and has a client-cert section but no TLS section).</p>
<p>Also, if the request is sent on <code>http</code> endpoint (not <code>https</code>) I observed that the client-cert is ignored even if the annotation value is set to <code>on</code>. Is this a documented behavior?</p>

sg1993
<p>If you define two ingresses as described then a certificate will be required unless you specify auth-tls-verify-client as optional. See the documentation mentioned in the comments.</p>
<p>Also TLS is required if you want to do client certificate authentication. The client certificate is used during the TLS handshake which is why specifying client certificates for one ingress applies to all where the host is the same (eg <a href="http://www.example.com" rel="nofollow noreferrer">www.example.com</a>)</p>
