<h3>The Problem</h3>

<p>I need to expose a Kubernetes NodePort service externally over https.</p>

<h3>The Setup</h3>

<ul>
<li>I've deployed Kubernetes on bare-metal and have deployed <a href="https://github.com/polyaxon/polyaxon" rel="noreferrer">Polyaxon</a> on the cluster via Helm</li>
<li>I need to access Polyaxon's dashboard via the browser, using a virtual machine that's external to the cluster</li>
<li>The dashboard is exposed as a NodePort service, and I'm able to connect to it over http. I am <strong>not</strong> able to connect over https, which is a hard requirement in my case.</li>
<li>Following an initial "buildout" period, both the cluster and the virtual machine will not have access to the broader internet. They will connect to one another and that's it.</li>
</ul>

<p>Polyaxon supposedly supports SSL/TLS through its own configs, but there's very little documentation on this. I've made my best attempts to solve the issue that way and also bumped <a href="https://github.com/polyaxon/polyaxon/issues/288" rel="noreferrer">an issue</a> on their github, but haven't had any luck so far.</p>

<p>So I'm now wondering if there might be a more general Kubernetes hack that could help me here. </p>

<h3>The Solutions</h3>

<p>I'm looking for the simplest solution, rather than the most elegant or scalable. There are also some things that might make my situation simpler than the average user who would want https, namely:</p>

<ul>
<li>It would be OK to support https on just one node, rather than every node</li>
<li>I don't need (or really want) a domain name; connecting at <code>https://&lt;ip_address&gt;:&lt;port&gt;</code> is not just OK but preferred</li>
<li>A self-signed certificate is also OK</li>
</ul>

<p>So I'm hoping there's some way to manipulate the NodePort service directly such that https will work on the virtual machine. If that's not possible, other solutions I've considered are using an Ingress Controller or some sort of proxy, but those solutions are both a little half-baked in my mind. I'm a novice with both Kubernetes and networking ideas in general, so if you're going to propose something more complex please speak very slowly :) </p>

<p>Thanks a ton for your help!</p>

JJL
<p>Ingress-controller it's a standard way to expose HTTP backend over TLS connection from cluster to client. </p>

<p>Existing <code>NodePort</code> service has <code>ClusterIP</code> which can be used as a backend for  Ingress. ClusterIP type of service is enough, so you can change service type later to prevent HTTP access via <code>nodeIP:nodePort</code>. 
Ingress-controller allows you to teminate TLS connection or pass-through TLS traffic to the backend.</p>

<p>You can use self-signed certificate or use cert-manager with <a href="https://itnext.io/automated-tls-with-cert-manager-and-letsencrypt-for-kubernetes-7daaa5e0cae4" rel="noreferrer">Let's encrypt</a> service.</p>

<p>Note, that starting from 0.22.0 version Nginx-ingress rewrite syntax <a href="https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/rewrite" rel="noreferrer">has changed</a> and some examples in the articles may be outdated.</p>

<p>Check the links:</p>

<ul>
<li><a href="https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/tls-termination" rel="noreferrer">TLS termination</a></li>
<li><a href="https://kubernetes.github.io/ingress-nginx/user-guide/tls/" rel="noreferrer">TLS/HTTPS</a></li>
<li><a href="https://stackoverflow.com/questions/49545732/how-to-get-kubernetes-ingress-to-terminate-ssl-and-proxy-to-service">How to get Kubernetes Ingress to terminate SSL and proxy to service?
</a></li>
<li><a href="https://blogs.technet.microsoft.com/livedevopsinjapan/2017/02/28/configure-nginx-ingress-controller-for-tls-termination-on-kubernetes-on-azure-2/" rel="noreferrer">Configure Nginx Ingress Controller for TLS termination on Kubernetes on Azure</a></li>
</ul>
