<p>I have so far configured servers inside Kubernetes containers that used HTTP or terminated HTTPS at the ingress controller. Is it possible to terminate HTTPS (or more generally TLS) traffic from outside the cluster directly on the container, and how would the configuration look in that case? </p>

<p>This is for an on-premises Kubernetes cluster that was set up with <code>kubeadm</code> (with Flannel as CNI plugin). If the Kubernetes <code>Service</code> would be configured with <code>externalIPs 1.2.3.4</code> (where <code>my-service.my-domain</code> resolves to <code>1.2.3.4</code>) for service access from outside the cluster at <code>https://my-service.my-domain</code>, say, how could the web service running inside the container bind to address <code>1.2.3.4</code> and how could the client verify a server certificate for <code>1.2.3.4</code> when the container's IP address is (FWIK) some local IP address instead? I currently don't see how this could be accomplished.</p>

<p><strong>UPDATE</strong> My current understanding is that when using an <code>Ingress</code> HTTPS traffic would be terminated at the ingress controller (i.e. at the "edge" of the cluster) and further communication inside the cluster towards the backing container would be unencrypted. What I want is encrypted communication all the way to the container (both outside and inside the cluster).</p>

rookie099
<p>I guess, Istio envoy proxies is what you need, with the main purpose to authenticate, authorize and encrypt service-to-service communication.</p>

<p>So, you need a  mesh with <a href="https://istio.io/docs/concepts/security/#mutual-tls-authentication" rel="nofollow noreferrer">mTLS authentication</a>, also known as service-to-service authentication.</p>

<p>Visually,  <strong>Service A</strong> is your Ingress service and <strong>Service B</strong> is a service for HTTP container</p>

<p><a href="https://i.stack.imgur.com/yitAZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yitAZ.png" alt="enter image description here"></a></p>

<p>So, you terminate external TLS traffic on the ingress controller and it will go further inside the cluster with Istio mTLS encryption. </p>

<p>It's not exactly what you asked for -</p>

<blockquote>
  <p>terminate HTTPS traffic directly on Kubernetes container</p>
</blockquote>

<p>Though it fulfill the requirement- </p>

<blockquote>
  <p>What I want is encrypted communication all the way to the container</p>
</blockquote>
