<p>I have a service deployed in Google Kubernetes Engine and have gotten the request to support TLS 1.3 connections on that service. Currently I do not get higher than TLS 1.2. Do I need to define my ingress differently?</p>
<p>My ingress is</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: service-tls-__CI_ENVIRONMENT_SLUG__
  namespace: __KUBE_NAMESPACE__
  labels:
    app: __CI_ENVIRONMENT_SLUG__
    ref: __CI_ENVIRONMENT_SLUG__
  annotations:
    kubernetes.io/tls-acme: &quot;true&quot;
    kubernetes.io/ingress.class: &quot;nginx&quot;
    cert-manager.io/cluster-issuer: &quot;letsencrypt-prod&quot;
spec:
  tls:
  - hosts:
    - __SERVICE_TLS_ENDPOINT__
    secretName: __CI_ENVIRONMENT_SLUG__-service-cert
  rules:
  - host: __SERVICE_TLS_ENDPOINT__
    http:
      paths:
      - path: /
        backend:
          serviceName: service-__CI_ENVIRONMENT_SLUG__
          servicePort: 8080
</code></pre>
<p>Master version 1.17.13-gke.600
Pool version 1.17.13-gke.600</p>

Eelke
<p>Your <code>Ingress</code> resource looks good. I used the same setup as yours and received a message that <code>TLS 1.3</code> was supported.</p>
<p>The official documentation states:</p>
<blockquote>
<h3>Default TLS Version and Ciphers</h3>
<p>To provide the most secure baseline configuration possible,</p>
<p>nginx-ingress defaults to using TLS 1.2 and <strong>1.3</strong> only, with a <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-ciphers" rel="nofollow noreferrer">secure set of TLS ciphers</a>.</p>
</blockquote>
<p>Please check which version of <code>nginx-ingress-controller</code> you are running:</p>
<ul>
<li><em><a href="https://kubernetes.github.io/ingress-nginx/deploy/#detect-installed-version" rel="nofollow noreferrer">Kubernetes.github.io: Ingress-nginx: Deploy: Detect installed version </a></em></li>
</ul>
<p>Also you can check if <code>TLS 1.3</code> is enabled in <code>nginx.conf</code> of your <code>nginx-ingress-controller</code> pod (<code>ssl_protocols TLSv1.2 TLSv1.3;</code>). You will need to <code>exec</code> into the pod.</p>
<hr />
<h2>Troubleshooting steps for ensuring support for <code>TLS 1.3</code></h2>
<hr />
<h3>Does your server (<code>nginx-ingress</code>) supports <code>TLS 1.3</code>?</h3>
<p>You can check if your <code>Ingress</code> controller supports it by running an online analysis:</p>
<ul>
<li><em><a href="https://www.ssllabs.com/ssltest/analyze.html" rel="nofollow noreferrer">SSLLabs.com: SSLTest: Analyze</a></em></li>
</ul>
<p>You should get a message stating that <code>TLS 1.3</code> is supported:</p>
<p><a href="https://i.stack.imgur.com/jzyV6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/jzyV6.png" alt="ANALYSIS" /></a></p>
<p>You can also use alternative online tools:</p>
<ul>
<li><em><a href="https://gf.dev/tls-test" rel="nofollow noreferrer">Geekflare.dev: TLS test</a></em></li>
<li><em><a href="https://geekflare.com/ssl-test-certificate/" rel="nofollow noreferrer">Geekflare.com: 10 Online Tool to Test SSL, TLS and Latest Vulnerability</a></em></li>
</ul>
<hr />
<h3>Does your client supports <code>TLS 1.3</code>?</h3>
<p>Please make sure that the client connecting to your <code>Ingress</code> supports <code>TLS 1.3</code>.</p>
<p>The client connecting to the server was not mentioned in the question:</p>
<ul>
<li>Assuming that it's a <strong>web browser</strong>, you can check it with a similar tool to the one used for a server:
<ul>
<li><em><a href="https://clienttest.ssllabs.com:8443/ssltest/viewMyClient.html" rel="nofollow noreferrer">Clienttest.ssllabs.com:8443: SSLTest: ViewMyClient</a></em></li>
</ul>
</li>
<li>Assuming that it is some other tool (<code>curl</code>, <code>nmap</code>, <code>openssl</code>, etc.) please check  its documentation for more reference.</li>
</ul>
<hr />
<p>Additional reference:</p>
<ul>
<li><em><a href="https://github.com/kubernetes/ingress-nginx/issues/2384" rel="nofollow noreferrer">Github.com: Kubernetes: Ingress nginx: Enable tls 1.3 in the nginx image</a></em></li>
<li><em><a href="https://en.wikipedia.org/wiki/Transport_Layer_Security_Adoption" rel="nofollow noreferrer">En.wikipedia.org: Wiki: Transport Layer Security Adoption</a></em></li>
</ul>
