<p>How can I enable nginx ingress to support end-to-end TLS connection without passthrough. The Ingress LoadBalancer is allowed with PublicCA and backend servers are also running on TLS port with PrivateCA </p>

<p><a href="https://i.stack.imgur.com/iewiE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/iewiE.png" alt=""></a></p>

<p>The following ingress definition will do the TLS offloading with the Public certificate installed on the Edge. </p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
  name: wbqgdimtzx
  namespace: default
spec:
  rules:
  - host: 0cloud0.com
    http:
      paths:
      - backend:
          serviceName: wbqgdimtzx
          servicePort: 443
        path: /
  tls:
  - hosts:
    - 0cloud0.com
  secretName: 0cloud0-wildcard-certs
status:
  loadBalancer:
    ingress:
    - {}
</code></pre>

<p>The backend pods are running on secure port where plain text connection is not allowed for security reasons. </p>

<p>What upstream changes do I need to do in the nginx ingress to support the end-to-end setting?</p>

<p>Based on Amit Response added </p>

<blockquote>
  <p>nginx.ingress.kubernetes.io/backend-protocol: HTTPS</p>
</blockquote>

<p>It worked <a href="https://0cloud0.com/" rel="nofollow noreferrer">https://cunkexvoxu.0cloud0.com/</a></p>

anish
<p>Based on @Amit Kumar Gupta comment, I am posting this as community wiki for better visibility.</p>

<p>As OP in his YAML specified backend with <code>servicePort: 443</code> and <code>tls</code>, however it was not enought to ensure secure end2end connection.
NGINX as default is using <code>HTTP</code>. If you want to reach your service only as <code>HTTPS</code> you have to add annotation to <code>Ingress</code> YAML.</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: wbqgdimtzx
  namespace: default
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
...
</code></pre>
