TLS termination with Ingress in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is TLS termination in Kubernetes Ingress?

In Kubernetes, what does TLS termination mean when used with an Ingress resource?

A The Ingress controller decrypts incoming TLS traffic and forwards unencrypted traffic to backend services.

B TLS termination means encrypting traffic between backend services and the Ingress controller.

C The backend services handle TLS decryption and encryption directly without Ingress involvement.

D TLS termination disables TLS encryption entirely for all traffic in the cluster.

💡 Hint

Think about where the encrypted traffic is decrypted in the flow from client to backend.

TLS termination means the Ingress controller handles decrypting the encrypted traffic from clients. It then sends plain HTTP traffic to backend services. This offloads TLS work from the backend.

❓ Configuration

intermediate

Identify the correct TLS section in an Ingress manifest

Which TLS configuration snippet correctly enables TLS termination for the host example.com in a Kubernetes Ingress manifest?

A

tls:
  hosts: example.com
  secretName: example-tls

B

tls:
  - hosts:
    - example.com
    secretName: example-tls

C

tls:
  - host: example.com
    secretName: example-tls

D

tls:
  - hosts:
    - example.com
    secret: example-tls

💡 Hint

Check the indentation and key names carefully for the TLS section.

The TLS section requires a list of hosts under the key hosts and the secret name under secretName. Option B matches the correct syntax.

💻 Command Output

advanced

What is the output of describing an Ingress with TLS configured?

Given an Ingress resource with TLS configured for example.com, what will kubectl describe ingress my-ingress show under the TLS section?

A

TLS:
  example.com -> example-tls

B

TLS:
  example.com, secretName: example-tls

C

TLS:
  example.com terminates at secret example-tls

D

TLS:
  Hosts: example.com
  SecretName: example-tls

💡 Hint

Look at the typical output format of kubectl describe ingress for TLS info.

The kubectl describe ingress command shows TLS hosts and secret names with keys Hosts and SecretName. Option D matches the expected output format.

❓ Troubleshoot

advanced

Why does HTTPS fail despite TLS configured in Ingress?

You configured TLS in your Ingress with a valid secret, but HTTPS requests fail with a connection error. What is the most likely cause?

A The TLS secret is missing the private key file.

B The backend service is not listening on port 443.

C The Ingress controller is not running or not configured to handle TLS.

D The Ingress resource is missing the <code>spec.rules</code> section.

💡 Hint

Think about what component handles TLS termination and if it is active.

If the Ingress controller is not running or does not support TLS, HTTPS connections will fail even if the Ingress resource has TLS configured. The controller must be active and properly configured.

✅ Best Practice

expert

Best practice for securing backend services with TLS after Ingress termination

After TLS termination at the Ingress controller, what is the best practice to secure traffic between the Ingress controller and backend services?

A Use mutual TLS (mTLS) between the Ingress controller and backend services to encrypt traffic internally.

B Send plain HTTP traffic from Ingress to backend services to reduce latency.

C Disable TLS on backend services since Ingress already handles encryption.

D Use IP whitelisting on backend services instead of encryption.

💡 Hint

Consider how to protect traffic inside the cluster after TLS termination.

Even after TLS termination at the Ingress, encrypting traffic internally with mutual TLS (mTLS) between Ingress and backend services adds security by protecting internal communication.