<p><strong>If I have a backend implementation for TLS, does Ingress NGINX expose it correctly?</strong></p>
<p>I'm exposing an MQTT service through an Ingress NGNIX with the following configuration:</p>
<p><strong>ConfigMap:</strong></p>
<pre><code>---

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-ingress-tcp-microk8s-conf
  namespace: ingress
#Add the service we want to expose
data:
  1883: &quot;default/mosquitto-broker:1883&quot;
</code></pre>
<p><strong>DaemonSet:</strong></p>
<pre><code>---
apiVersion: apps/v1
kind: DaemonSet
   ...
spec:
  selector:
    matchLabels:
      name: nginx-ingress-microk8s
  template:
    metadata:
   ...
    spec:
      ...
        ports:
        - containerPort: 80
        - containerPort: 443
#Add the service we want to expose
        - name: prx-tcp-1883
          containerPort: 1883
          hostPort: 1883
          protocol: TCP
        args:
        - /nginx-ingress-controller
        - --configmap=$(POD_NAMESPACE)/nginx-load-balancer-microk8s-conf
        - --tcp-services-configmap=$(POD_NAMESPACE)/nginx-ingress-tcp-microk8s-conf
        - --udp-services-configmap=$(POD_NAMESPACE)/nginx-ingress-udp-microk8s-conf
        $DEFAULT_CERT
        $EXTRA_ARGS
</code></pre>
<p>I have configured the MQTT broker to use TLS in the backend. When I run the broker in my machine, outside the kubernetes cluster, Wireshark detects the messages as TLS, and it doesn't show anything about MQTT:</p>
<p><a href="https://i.stack.imgur.com/DvAnT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/DvAnT.png" alt="enter image description here" /></a></p>
<p>However, if I run the broker inside the cluster, it shows that im using MQTT, and nothing about TLS. But the messages aren't read correctly:
<a href="https://i.stack.imgur.com/Jay4R.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Jay4R.png" alt="enter image description here" /></a></p>
<p>And finally, if I run the MQTT broker inside the cluster without TLS, Wireshark detects correctly the MQTT pakcets:
<a href="https://i.stack.imgur.com/QoudM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QoudM.png" alt="enter image description here" /></a></p>
<p>My question is: <strong>Is the connection encrypted when I use TLS inside the cluster?</strong> It's true that Wireshark doesn't show the content of the packets, but it knows I'm using MQTT. Maybe it's because the headers aren't encrypted, but the payload is? Does anyone knows exactly?</p>

Manu Ruiz Ruiz
<p>The problem was that I was running TLS MQTT in port 8883 as recommended by the documentation (not in 1883 port for standar MQTT), but Wireshark didn't recognise this port as an MQTT port, so the format given by Wireshark was kinda broken.</p>
