Ingress and SSL Passthrough

Question

I have recently been using the nginxdemo/nginx-ingress controller.

As I understand it this controller cannot do SSL Passthrough (by that I mean pass the client certificate all the way through to the backend service for authentication), so instead I have been passing the clients subject DN through a header.

Ultimately I would prefer SSL-Passthrough and have been looking at the kubernetes/ingress-nginx project which apparently supports SSL passthrough.

Does anyone have an experience with this controller and SSL Passthrough.

The few Ingress examples showing passthrough that I have found leave the path setting blank.

Is this because passthrough has to take place at the TCP level (4) rather then at HTTP (7)?

Right now, I have a single host rule that services mutiple paths.

Answer 1

completing on lch answer I would like to add that I had the same problem recently and I sorted it out modifiying the ingress-service deployment (I know, it should be a DaemonSet but that's a different story)

The change was adding the parameter to spec.containers.args:

  --enable-ssl-passthrough                                        

Then I've added the following annotations to my ingress:

kubernetes.io/ingress.allow-http: "false"
nginx.ingress.kubernetes.io/secure-backends: "true"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
nginx.ingress.kubernetes.io/ssl-redirect: "true"

The important one are secure-backends and ssl-passthrough but I think the rest are a good idea, provided you're not expecting http traffic there

Answer 2

SSH-Passthrough is working fine for me. Here is the Official Documentation

And here is an example usage:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-service-ingress
  namespace: my-service
  annotations:
    kubernetes.io/ingress.allow-http: "false"
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    nginx.ingress.kubernetes.io/secure-backends: "true"
spec:
  rules:
    - host: my.example.com
      http:
        paths:
          - backend:
              serviceName: my-service