title: How to get Kubernetes Ingress to terminate SSL and proxy to service?
body: <p>I have a centos7 deployment with kubernetes on bare metal. Everything works great. However, i would like to get an <code>Ingress</code> working. so in brief what i want to do is to terminate the SSL from within the Ingress and have plain http between the ingress and my service. this is what i did:</p>
  
  <p>1) i <a href="https://github.com/weaveworks/weave/issues/3016#issuecomment-321337923" rel="nofollow noreferrer">hack weave to allow <code>hostNetwork</code></a></p>
  
  <p>2) i have an ingress controller set up as per:</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: DaemonSet
  metadata:
    name: nginx-ingress-controller
    namespace: ingress-nginx
    labels:
      k8s-app: nginx-ingress-lb
      kubernetes.io/cluster-service: "true"
  spec:
    template:
      metadata:
        labels:
          k8s-app: nginx-ingress-lb
          name: nginx-ingress-lb
      spec:
        hostNetwork: true
        terminationGracePeriodSeconds: 60
        serviceAccountName: nginx-ingress-serviceaccount
        nodeSelector:
          role: edge-router
        containers:
        - image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.12.0
          name: nginx-ingress-lb
          imagePullPolicy: Always
          readinessProbe:
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
          livenessProbe:
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
          # use downward API
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          ports:
            - containerPort: 80
              hostPort: 80
            - containerPort: 443
              hostPort: 443
          args:
            - /nginx-ingress-controller
            - --default-backend-service=$(POD_NAMESPACE)/default-http-backend
            - --enable-ssl-passthrough
            # - --default-ssl-certificate=$(POD_NAMESPACE)/tls-certificate
          volumeMounts:
            - name: tls-dhparam-vol
              mountPath: /etc/nginx-ssl/dhparam
        volumes:
          - name: tls-dhparam-vol
            secret:
              secretName: tls-dhparam
  </code></pre>
  
  <p>Note the DaemonSet and the nodeSelector. Also the <code>hostNetwork = true</code> so that my kubernetes nodes will open up 80 and 443 to listen for routing). </p>
  
  <p>So i attempt to go to <a href="http://foo.bar.com" rel="nofollow noreferrer">http://foo.bar.com</a> and unsurprisingly, nothing. i just get the <code>default backend - 404</code> page. i need the ingress rule....</p>
  
  <p>3) so i create a <code>Ingress</code> rule like this:</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: hub
    annotations:
      kubernetes.io/ingress.class: "nginx"
      ingress.kubernetes.io/ssl-redirect: "true"
      nginx.ingress.kubernetes.io/rewrite-target: /
      nginx.org/ssl-services: "hub"
  spec:
    tls:
    - hosts:
      - foo.bar.com
      secretName: tls-dhparam
    rules:
    - host: foo.bar.com
      http:
        paths:
        - path: /
          backend:
            serviceName: hub
            servicePort: 8000
  </code></pre>
  
  <p>So it works great!... for http... when i go to my node at <a href="http://foo.bar.com" rel="nofollow noreferrer">http://foo.bar.com</a> i can access my service (hub) and can log on. however, as one has to log on it only makes sense to enforce https....</p>
  
  <p>so my problem is that when i switch my browser over to <a href="https://foo.bar.com" rel="nofollow noreferrer">https://foo.bar.com</a>, i end up with a the <code>default backend - 404</code> page.</p>
  
  <p>looking at the cert presented in the above, i see that it is one created by kubernetes:</p>
  
  <pre><code>Kubernetes Ingress Controller Fake Certificate
  Self-signed root certificate
  </code></pre>
  
  <p>checking my secrets:</p>
  
  <pre><code>$ kubectl -n ingress-nginx get secrets
  NAME                                       TYPE                                  DATA      AGE
  default-token-kkd2j                        kubernetes.io/service-account-token   3         12m
  nginx-ingress-serviceaccount-token-7f2sq   kubernetes.io/service-account-token   3         12m
  tls-dhparam                                Opaque                                1         8m
  </code></pre>
  
  <p>what am i doing wrong?</p>