TLS Passthrough

In this example, we show how to use a TransportServer resource to configure TLS Passthrough load balancing.

With the TLS Passthrough feature, the Ingress Controller accepts TLS connections on port 443 and routes them to the corresponding backend services without decryption. The routing is done based on the SNI, which allows clients to specify a server name (like example.com) during the SSL handshake. At the same time, the Ingress Controller continues to handle regular HTTPS traffic on the same port 443, terminating TLS connections using the TLS certificate and keys, specified through Ingress or VirtualServer resources.

We will deploy a backend application (we call it the secure app) that exposes port 8443 for TLS traffic. Then we will configure the Ingress Controller to route connections to the secure app using a TransportServer resource.

About the Secure App

The secure app is an NGINX pod (not to be confused with the Ingress Controller pod, which also includes NGINX) configured to serve HTTPS traffic on port 8443 for the host app.example.com. For TLS termination, a self-signed TLS certificate and key are used. The app responds to clients HTTPS requests with a simple text response hello from pod <hostname of the pod>.

You can see how the Secure App is implemented in the secure-app.yaml file.

Prerequisites

Follow the installation instructions to deploy the Ingress Controller:
- As part of Step 2 of those instructions, make sure to deploy the custom resource definition for the TransportServer resource.
- Set the -enable-custom-resources and -enable-tls-passthrough command-line arguments of the Ingress Controller to enable the TLS Passthrough feature.
Save the public IP address of the Ingress Controller into a shell variable:
```
$ IC_IP=XXX.YYY.ZZZ.III
```
Save the HTTPS port of the Ingress Controller into a shell variable:
```
$ IC_HTTPS_PORT=<port number>
```

Step 1 - Deploy the Secure App

Create the secure app deployment and service:

$ kubectl apply -f secure-app.yaml

Step 2 - Configure Load Balancing

Create the TransportServer resource to configure TLS Passthrough:
```
$ kubectl apply -f transport-server-passthrough.yaml
```

Check that the configuration has been successfully applied by inspecting the events of the TransportServer:

$ kubectl describe ts secure-app
. . .
Events:
  Type    Reason          Age   From                      Message
  ----    ------          ----  ----                      -------
  Normal  AddedOrUpdated  9s    nginx-ingress-controller  Configuration for default/secure-app was added or updated

Step 3 - Test the Configuration

Now we access the secure app using curl. We'll use curl's --insecure option to turn off certificate verification of the app self-signed certificate and --resolve option to set the IP address and HTTPS port of the Ingress Controller to the domain name of the cafe application:

$ curl --resolve app.example.com:$IC_HTTPS_PORT:$IC_IP https://app.example.com:$IC_HTTPS_PORT --insecure
hello from pod secure-app-d986bcf6b-jwm2s