How deeply does Kubernetes in Action, Second Edition cover passthrough?

Explains gateway visibility, listener configuration, TLSRoutes, and controller-specific Ingress setup without detailing controller internals.

Passthrough

As explained in Kubernetes in Action, Second Edition

TLS passthrough is a traffic-handling technique in which an ingress component forwards encrypted TLS connections to a backend instead of terminating TLS itself.

TLS passthrough forwards an encrypted TLS connection through an ingress component or gateway to a backend, which terminates TLS. The gateway does not decrypt HTTP requests; it can identify the destination hostname from TLS SNI. section 13.4 section 13.4.2

Passthrough changes what the gateway can do and which routing resources are required:

Preserves encryption from the client to the backend; unencrypted HTTP need not cross the network. section 13.4.2
Limits gateway knowledge to the TLS destination hostname, so HTTPRoutes cannot inspect or route the encrypted HTTP traffic. section 13.4 section 13.4.2
Requires a TLSRoute for backend routing when configured through the Gateway API. section 13.4.2

With the Gateway API, configure a port-443 listener with protocol TLS and tls.mode set to Passthrough, then attach a TLSRoute that names the hostname and backend service. The backend service listens on TLS, while the gateway forwards the connection without terminating it. section 13.4.2

Gateway API configuration

A listener uses protocol TLS on port 443 with tls.mode: Passthrough. A TLSRoute then references the gateway, matches kiada.example.com, and forwards traffic to the kiada-stable Service on port 443. Without the TLSRoute, the gateway accepts no usable backend route and the connection is refused.

Listing 12.7 Enabling SSL passthrough when using the Nginx ingress controller

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kiada-ssl-passthrough
  annotations:
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"     #1
spec:
  ...

Ingress controllers may expose passthrough through controller-specific configuration rather than a standard Ingress field. Nginx requires the ssl-passthrough annotation and must be started with --enable-ssl-passthrough. section 12.3.1

How Kubernetes in Action, Second Edition covers it

Cover of Kubernetes in Action, Second Edition

liveBook manning.com

Read Kubernetes in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

TLS terminationalternative to · TLS termination is the process of ending a TLS connection and decrypting its traffic at an endpoint or intermediary for processing or forwarding.
gateway objectconfigured by · A Kubernetes Gateway API Gateway is a resource that defines a network entry point and specifies its implementation class, listeners, and traffic protocols or ports.
TLSRouteuses · A TLSRoute is a Kubernetes Gateway API resource that routes TLS traffic to backend services using information available from the encrypted connection, primarily the recipient hostname.
ingress controlleruses · An ingress controller is a Kubernetes component that implements Ingress routing rules by directing external network traffic to services within a cluster.
annotationconfigured by · A Kubernetes annotation is key-value metadata attached to an object for storing non-identifying descriptive, configuration, or operational information.
ingress objectconfigured by · A Kubernetes Ingress is an API resource that specifies rules for routing external HTTP and HTTPS requests to services within a cluster.

This explainer was generated by Manning's knowledge graph from the text of Kubernetes in Action, Second Edition. The section links point to the parts of the book it draws on.