Which TLS termination option passes TLS end-to-end to the pods?

Which TLS termination option passes TLS end-to-end to the pods?

• A. Edge termination
• B. Passthrough
• C. Reencrypt
• D. TLS passthrough

Answer: (B)

End-to-end TLS to the pods happens when the router does not terminate the TLS session at all; it simply forwards the encrypted traffic to the backend so the pods handle the TLS handshake themselves. This mode is called passthrough. It keeps encryption from the client all the way to the pod, allowing the pod to present its own certificate and terminate TLS there. The other options terminate TLS at the router (edge termination) or terminate and then re-encrypt to the backend (reencrypt), so they do not preserve end-to-end encryption. Sometimes you’ll also see the same concept referred to as TLS passthrough, but in OpenShift terminology the mode that delivers end-to-end TLS to the pods isPassthrough.

End-to-end TLS to the pods happens when the router does not terminate the TLS session at all; it simply forwards the encrypted traffic to the backend so the pods handle the TLS handshake themselves. This mode is called passthrough. It keeps encryption from the client all the way to the pod, allowing the pod to present its own certificate and terminate TLS there. The other options terminate TLS at the router (edge termination) or terminate and then re-encrypt to the backend (reencrypt), so they do not preserve end-to-end encryption. Sometimes you’ll also see the same concept referred to as TLS passthrough, but in OpenShift terminology the mode that delivers end-to-end TLS to the pods isPassthrough.