TLS termination

Learn TLS termination on Ingress.

TLS termination

The Ingress decrypts the HTTPS connection itself (TLS termination) and forwards plain HTTP to the service. The certificate is kept in a kubernetes.io/tls Secret and attached with spec.tls:

spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - magaza.example.com
      secretName: magaza-tls
  rules:
    - host: magaza.example.com
      ...

ingress-nginx redirects HTTP requests to HTTPS by default for hosts with TLS defined.

cert-manager

Instead of renewing certificates by hand, cert-manager gets and renews them automatically from Let's Encrypt. Adding an annotation to the Ingress is enough; cert-manager creates the Secret:

metadata:
  name: magaza
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  tls:
    - hosts: [magaza.example.com]
      secretName: magaza-tls        # cert-manager fills it

Exercise An Ingress with HTTPS

Two steps: first write the command creating the magaza-tls TLS Secret from the magaza.crt and magaza.key files; then write an Ingress's tls section (starting with tls:): host magaza.example.com, secretName: magaza-tls.

Show example solution

kubectl create secret tls magaza-tls --cert=magaza.crt --key=magaza.key

tls:
  - hosts:
      - magaza.example.com
    secretName: magaza-tls

Test yourself

What happens if the name in tls.hosts doesn't match the host in rules?
- The Ingress is deleted
- HTTP closes
- It doesn't matter
- The certificate isn't used for that host; the controller serves its default (fake) certificate
Show answer

The certificate isn't used for that host; the controller serves its default (fake) certificate — The browser shows an "insecure connection" warning.

Give the certificate's Secret.

  tls:
    - hosts:
        - magaza.example.com
      ____: magaza-tls

Show answer

  tls:
    - hosts:
        - magaza.example.com
      secretName: magaza-tls

Match.

TLS termination

HTTPS decrypted at the Ingress
spec.tls

Attaching the certificate
kubernetes.io/tls

Secret type
cert-manager

Automatic certificate

Next lesson: Summary - Ingress

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies