# How Ingress(nginx) controller and Nodes are communicated on https protocol?

**URL:** <https://forum.opensearch.org/t/how-ingress-nginx-controller-and-nodes-are-communicated-on-https-protocol/24231>\
**Category:** Kubernetes\
**Tags:** discuss, troubleshoot, configure, security-issue\
**Created:** [April 29, 2025, 9:21am UTC](https://forum.opensearch.org/t/how-ingress-nginx-controller-and-nodes-are-communicated-on-https-protocol/24231 "2025-04-29T09:21:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yeonghyeonKo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/yeonghyeonko/32/8202_2.png) [@yeonghyeonKo](https://forum.opensearch.org/u/yeonghyeonKo)\
**Post date:** [April 29, 2025, 9:21am UTC](https://forum.opensearch.org/t/how-ingress-nginx-controller-and-nodes-are-communicated-on-https-protocol/24231/1 "2025-04-29T09:21:06Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
opensearch 2.17.1 and opensearch-k8s-operator 2.3.0

**Describe the issue** :

- When trying to deploy K8s **Ingress** API resource for OpenSearch’s service (port: 9200), it requires `metadata.annotations` to have `ingress.kubernetes.io/backend-protocol: https` if we want to generate self-signed ca and its certificates for [HTTP layer](https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/userguide/main.md#node-httprest-api).

- I’ve already made it possible to implement the below flow and K8s Secrets:

```md
User -(1)-> Ingress Controller(Nginx) -(2)-> Cluster 
# (1) : client(for web browser) certificate
# (2) : backend certificate for HTTP layer created by cert-manager

```

```auto
$ kubectl get secret
NAME TYPE DATA AGE
admin-credentials-secret Opaque 2 29d
test-opensearch-cluster-admin-cert kubernetes.io/tls 3 29d
test-opensearch-cluster-admin-password Opaque 2 29d
test-opensearch-cluster-ca kubernetes.io/tls 3 29d
test-opensearch-cluster-http-cert kubernetes.io/tls 3 29d
test-opensearch-cluster-transport-cert kubernetes.io/tls 3 29d
client-tls kubernetes.io/tls 2 24h
securityconfig-secret Opaque 8 29d

```

* * *

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    ingress.kubernetes.io/backend-protocol: https

    ############################################################################################################################
    # ingress.kubernetes.io/proxy-ssl-name: test-opensearch-cluster # CN for test-opensearch-cluster-http-cert
    # ingress.kubernetes.io/proxy-ssl-secret: test-opensearch-cluster-ca # A Secret for CA which would verifies test-opensearch-cluster-http-cert
    ############################################################################################################################
  name: test-opensearch-cluster-os
  namespace: test-opensearch-cluster
spec:
  ingressClassName: nginx
  rules:
  - host: test-opensearch-cluster-os.a.b.com
    http:
      paths:
      - backend:
          service:
            name: test-opensearch-cluster
            port:
              number: 9200
        path: /
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - test-opensearch-cluster-os.a.b.com
    secretName: client-tls

```

- I was just wondering whether the ingress controller has self-signed CA certificates (created by cert-manager) and how it makes handshakes between the cluster itself without specifying `proxy-ssl-name` & `proxy-ssl-secret`?  
(Does opensearch-k8s-operator automatically achieve it?)

---

<div class="post-metadata">

**Author:** ![yeonghyeonKo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/yeonghyeonko/32/8202_2.png) [@yeonghyeonKo](https://forum.opensearch.org/u/yeonghyeonKo)\
**Post date:** [April 30, 2025, 6:10am UTC](https://forum.opensearch.org/t/how-ingress-nginx-controller-and-nodes-are-communicated-on-https-protocol/24231/2 "2025-04-30T06:10:16Z")

</div>

> **Self-answer : Without the adequate settings for `proxy-ssl-*`, the client(NGINX ingress controller) won’t verify the server’s certificate so it becomes susceptible to MitM attacks.**

- In a one-way TLS handshake, the server presents its public certificate to the client, and the client is responsible for verifying this certificate against its truststore. This verification step is crucial for ensuring the authenticity and integrity of the server.

- If `proxy-ssl-verify` is set to `off`, the client does not perform the verification step where it checks the server’s certificate against its truststore. Here’s what happens as a result:

- It’s important to keep `proxy-ssl-verify` enabled (set to `on`) to ensure that the client verifies the server’s certificate. I believe this is a fundamental aspect of establishing a secure TLS connection and helps protect against attacks that could compromise confidential data when it comes to managing databases like OpenSearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [June 29, 2025, 6:10am UTC](https://forum.opensearch.org/t/how-ingress-nginx-controller-and-nodes-are-communicated-on-https-protocol/24231/3 "2025-06-29T06:10:57Z")

</div>

Closed on June 29, 2025, 6:10am UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.