TLS termination with Ingress in Kubernetes - Step-by-Step Execution

Process Flow - TLS termination with Ingress

Client sends HTTPS request

↓

Ingress Controller receives request

↓

Ingress decrypts TLS (TLS Termination)

↓

Ingress forwards plain HTTP to Service

↓

Service routes to Pod

↓

Pod responds

↓

Ingress encrypts response (if needed)

↓

Client receives response

The Ingress controller handles HTTPS requests by decrypting TLS, then forwards plain HTTP to backend services, simplifying TLS management.

Execution Sample

Kubernetes

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
spec:
  tls:
  - hosts:
    - example.com
    secretName: tls-secret
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: example-service
            port:
              number: 80

This Ingress resource configures TLS termination for example.com using tls-secret and routes HTTP traffic to example-service.

Process Table

Step	Action	Input	Output/Result
1	Client sends HTTPS request	https://example.com	Encrypted request sent to Ingress
2	Ingress receives request	Encrypted HTTPS request	Ingress decrypts TLS using tls-secret
3	Ingress forwards request	Plain HTTP request	Request sent to example-service on port 80
4	Service routes to Pod	HTTP request	Pod receives HTTP request
5	Pod processes request	HTTP request	Pod sends HTTP response
6	Ingress sends response	HTTP response	Ingress forwards response to client (usually encrypted)
7	Client receives response	Encrypted HTTPS response	Client displays content
Exit	End of request cycle	N/A	Request completed successfully

💡 Request cycle ends after client receives the response

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	Final
Request State	Encrypted HTTPS	Decrypted HTTP	Plain HTTP forwarded	HTTP response generated	Encrypted HTTPS response

Key Moments - 3 Insights

Why does the Ingress decrypt the TLS instead of the backend service?

Ingress handles TLS termination to centralize certificate management and reduce complexity for backend services, as shown in step 2 and 3 of the execution table.

Is the traffic between Ingress and backend service encrypted?

No, after TLS termination, Ingress forwards plain HTTP to the backend service, as seen in step 3 and 4.

What is the role of the tls-secret in the Ingress?

The tls-secret contains the TLS certificate and key used by Ingress to decrypt incoming HTTPS requests, referenced in the execution sample and step 2.

Visual Quiz - 3 Questions

Look at the execution table, what is the state of the request after step 2?

A Decrypted HTTP

B Plain HTTP forwarded

C Encrypted HTTPS

D HTTP response generated

💡 Hint

Check the 'Output/Result' column for step 2 in the execution_table.

At which step does the backend Pod receive the request?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look for when the service routes the request to the Pod in the execution_table.

If the tls-secret is missing, what would happen at step 2?

A Ingress would forward encrypted request to backend

B Ingress would fail to decrypt TLS and reject the request

C Ingress would decrypt TLS using a default certificate

D Backend service would decrypt TLS instead

💡 Hint

Refer to the key_moments about the role of tls-secret and step 2 in the execution_table.

Concept Snapshot

TLS termination with Ingress:
- Ingress decrypts HTTPS using tls-secret
- Forwards plain HTTP to backend services
- Simplifies certificate management
- Backend services receive unencrypted traffic
- Client communication remains secure via TLS

Full Transcript

TLS termination with Ingress means the Ingress controller handles decrypting HTTPS requests using a TLS certificate stored in a secret. The client sends an encrypted HTTPS request to the Ingress. The Ingress decrypts the request and forwards it as plain HTTP to the backend service. The backend Pod processes the HTTP request and sends a response back through the Ingress, which then sends the encrypted response to the client. This setup centralizes TLS management at the Ingress, so backend services do not need to handle encryption. The tls-secret contains the certificate and key needed for decryption. If the secret is missing, the Ingress cannot decrypt TLS and will reject the request.