<p>Currently with the nginx ingress in kubernetes it will always respond to direct IP requests (i.e. <a href="http://1.1.1.1" rel="nofollow noreferrer">http://1.1.1.1</a>) with the default-backend and there doesn't appear to be a way of disabling it.</p>

<p>Worse, it will also respond to <a href="https://1.1.1.1" rel="nofollow noreferrer">https://1.1.1.1</a> in the same manner with a self-signed cert (you can override it but obviously even if you provide a valid cert, it still won't be valid against an IP request)  This is a major security vulnerability that causes any site using Kubernetes and nginx ingress to fail PCI compliance network scans.</p>

<p>AND there is no way of overriding this behavior in your ingress defintion.</p>

<p>I'm trying to figure out how without hacking to be able to prevent the default-backend from responding to https on an IP request given that there is never a case in a production environment where this would be secure and will always cause PCI failure.</p>

<p>How does one get the nginx ingress to not respond to https on an IP request?</p>

James Hancock
<p>So I finally worked around this for PCI purposes. It isn't satisfying but it works and they don't freak out. Just apply the default certificate as the same for your site. It isn't valid, but because it comes from a valid signing authority PCI scans allow it to go through.</p>
<p>Which is lame, but whatever.</p>
