Question

You deploy an Ingress resource named 'shop-ingress' in the 'ecommerce' namespace to expose an HTTPS endpoint for shop.example.com. You reference a TLS secret named 'shop-tls' in the spec.tls section. The Ingress controller is running and healthy, and HTTP requests to the host route correctly, but HTTPS requests fail with a default self-signed certificate being served instead of your certificate. Running 'kubectl get secret shop-tls -n default' shows the secret exists there. What is the most likely cause and correct fix?

Accepted Answer

The TLS secret must reside in the same namespace as the Ingress resource; create/copy 'shop-tls' into the 'ecommerce' namespace and reference it there.

Answer

Ingress cannot serve TLS at all; you must terminate TLS at a LoadBalancer Service instead and remove the spec.tls block.

Answer

The secret type is wrong; change it to Opaque so the Ingress controller can read the certificate keys.

Answer

You must add the annotation 'nginx.ingress.kubernetes.io/ssl-passthrough: true' so the controller loads the secret from the default namespace.