TLS termination ends a client’s HTTPS connection at an intermediary, usually an Ingress load balancer. The intermediary handles certificates and TLS processing, then forwards the request to an internal Service instead of making the application server manage the client-facing TLS connection. section 7.0 section 7.2.1
An Ingress can handle the connection in three ways:
- Terminate TLS and forward traffic to the backend over HTTP, typically across a secured cloud or cluster network. This can reduce application configuration and CPU overhead. section 7.2.1 section 7.3
- Terminate TLS and re-encrypt traffic before connecting to the backend over HTTPS. section 7.2.1
- Pass encrypted traffic through unchanged only with a Service of type LoadBalancer; Ingress does not provide TLS passthrough. section 7.2.1 section 7.2
Configure TLS termination with Kubernetes
Create or obtain a private key and certificate, store them as a Kubernetes Secret with `kubectl create secret tls`, and reference that Secret from the Ingress `tls.secretName` field. The Ingress can then terminate HTTPS while routing requests by hostname or path to internal Services. A self-signed certificate provides encryption for testing but does not provide identity verification. section 7.2.1
Figure 7.5 The Ingress terminates HTTPS (TLS) traffic and can forward it to the serving Pods over plain HTTP or HTTPS connections.
Shows the client-to-Ingress HTTPS connection and the Ingress-to-Pod HTTP or HTTPS alternatives. section 7.2.1
