TLS termination decrypts an HTTPS connection at an endpoint so the resulting request can be handled and forwarded. In Kubernetes, an ingress controller commonly acts as that front door: it checks the certificate, decrypts the request, and routes it to the application. This centralizes certificate renewal and TLS configuration instead of repeating them in every service. section 10.3
Choose the endpoint deliberately:
- Terminate TLS at ingress for large Kubernetes systems, using controllers such as NGINX or Traefik. section 10.3
- Recognize the trust boundary: ingress-to-application traffic may be unencrypted, or may use mutual TLS when internal encryption and authentication are required. section 10.4
- Terminate TLS inside Spring Boot for standalone or internal applications, or when encryption must continue into the application. section 10.4
Listing 10.1 Configuring TLS in Kubernetes with NGINX ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: acme-app
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod #1
nginx.ingress.kubernetes.io/ssl-redirect: "true" #2
spec:
tls:
- hosts:
- app.acme.com #3
secretName: acme-app-tls #4
rules:
- host: app.acme.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: acme-webapp
port:
number: 80
A Kubernetes Ingress manifest shows certificate management, HTTPS redirection, hostname routing, and forwarding to the application service. section 10.3
