We use nginxinc controller and as of now SSL/TLS termination happen at LoadBalancer but we want this termination happen at Backend.

[mahendra03]

Hi Team,

We use nginxinc controller and as of now SSL/TLS termination happen at LoadBalancer but we want this termination happen at Backend.

a) Wanted to know what all changes is required in ingress controller level?
b) wanted to know what all changes will be required by application team.

[vepatel]

Hi @mahendra03 , is this something which can provide you with a ref implementaion:

1. https://github.com/nginxinc/kubernetes-ingress/blob/v3.4.0/examples/custom-resources/basic-configuration/cafe-virtual-server.yaml#L8
2. https://github.com/nginxinc/kubernetes-ingress/blob/v3.4.0/examples/ingress-resources/complete-example/cafe-ingress.yaml#L10

[brianehlert]

we want this termination happen at Backend.

There are a couple ways to interpret this.

• you can terminate at the laodbalancer as you do today
• you can terminate at the ingress controller which is necessary if you need layer 7 routing logic or authentication or authorization applied.
• you can pass through the TLS traffic through the ingress controller to the backend

If you terminate at the ingress controller to allow it to handle traffic routing and manipulation, you can re-encrypt to the backend if you require end-to-end encryption.
With TLS passthrough, you lose the most functionality. You lose observability as well as traffic shaping and routing capabilities. But it is necessary for some applications.