TLS termination ends an encrypted client connection at an Ingress proxy or gateway. The intermediary decrypts the request and can forward ordinary HTTP to a backend that does not support TLS. section 12.3.2 section 13.4.1
A terminating proxy or gateway must be configured with:
- A TLS certificate and private key, normally stored in a Kubernetes Secret. section 12.3.2
- A hostname mapping whose TLS host matches the certificate name. section 12.3.2
- A termination setting: an Ingress references the Secret in its tls field, while a Gateway listener sets tls.mode to Terminate and references the Secret. section 12.3.2 section 13.4.1
Termination differs from TLS passthrough. A terminating intermediary decrypts traffic and can understand HTTP requests; passthrough leaves decryption to the backend, so the intermediary cannot inspect the requests and generally knows only the hostname from SNI. Termination is widely supported by Ingress controllers, whereas passthrough depends on controller-specific support and configuration. section 12.3.1 section 13.4
Terminating TLS at a Gateway
A Gateway HTTPS listener can terminate TLS with a certificate stored in the kiada-tls Secret: set protocol to HTTPS, port to 443, tls.mode to Terminate, and certificateRefs.name to kiada-tls. Clients then connect with HTTPS while the gateway can use HTTP toward the backend. Test access with curl --resolve kiada.example.com:443:172.18.255.200 https://kiada.example.com -k. section 13.4.1
Listing 13.15 Configuring the gateway to terminate TLS
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: kiada
spec:
gatewayClassName: istio
listeners:
- name: http
port: 80
protocol: HTTP
- name: https #1
port: 443 #1
protocol: HTTPS #1
tls: #1
mode: Terminate #2
certificateRefs: #3
- kind: Secret #3
name: kiada-tls #3
Inspect the complete Gateway manifest showing an HTTP listener alongside an HTTPS listener configured for TLS termination. section 13.4.1
