TLS termination
- Docker & Kubernetes course
- Advanced
- Lesson 5/70
- 4 min
Learn TLS termination on Ingress.
TLS termination
The Ingress decrypts the HTTPS connection itself (TLS termination) and forwards plain HTTP to the service. The certificate is kept in a kubernetes.io/tls Secret and attached with spec.tls:
spec:
ingressClassName: nginx
tls:
- hosts:
- magaza.example.com
secretName: magaza-tls
rules:
- host: magaza.example.com
...ingress-nginx redirects HTTP requests to HTTPS by default for hosts with TLS defined.
cert-manager
Instead of renewing certificates by hand, cert-manager gets and renews them automatically from Let's Encrypt. Adding an annotation to the Ingress is enough; cert-manager creates the Secret:
metadata:
name: magaza
annotations:
cert-manager.io/cluster-issuer: letsencrypt
spec:
tls:
- hosts: [magaza.example.com]
secretName: magaza-tls # cert-manager fills itPractice An Ingress with HTTPS
Two steps: first write the command creating the magaza-tls TLS Secret from the magaza.crt and magaza.key files; then write an Ingress's tls section (starting with tls:): host magaza.example.com, secretName: magaza-tls.
Starter code
# buraya yazSample solution
kubectl create secret tls magaza-tls --cert=magaza.crt --key=magaza.key
tls:
- hosts:
- magaza.example.com
secretName: magaza-tlsExpected output
secret/magaza-tls created ingress.networking.k8s.io/magaza configured
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 What happens if the name in tls.hosts doesn't match the host in rules?
- The Ingress is deleted
- HTTP closes
- It doesn't matter
- The certificate isn't used for that host; the controller serves its default (fake) certificate Correct answer
Explanation: The browser shows an "insecure connection" warning.
2 Give the certificate's Secret.
tls:
- hosts:
- magaza.example.com
____: magaza-tls tls:
- hosts:
- magaza.example.com
secretName: magaza-tlsExplanation: secretName is a Secret of type kubernetes.io/tls.
3 Match.
| Term | Meaning |
|---|---|
TLS termination |
HTTPS decrypted at the Ingress |
spec.tls |
Attaching the certificate |
kubernetes.io/tls |
Secret type |
cert-manager |
Automatic certificate |