Editing Contour Ingress Controller (section)

=== Encrypted Upstream Communication ===
While many (most?) upstream services are happy to just handle unencrypted communications, some require the use of TLS (HTTPS).  This is a problem since the Ingress terminates the SSL/TLS session and the resulting communication with the upstream service is unencrypted.  

This is a simple example of the power of the HTTPProxy, and the flexibility it provides over an Ingress.  The HTTPProxy allows the specification of what protocol (specifically, which encryption protocol) is used for communicating with the upstream service.  Here is the above example HTTPProxy communicating with the upstream service on port 443 using HTTPS (TLS):

 apiVersion: projectcontour.io/v1
 kind: HTTPProxy
 metadata:
   name: httpbinproxy
 spec:
   virtualhost:
     fqdn: httpbinproxy.davecheney.com
     tls:
       secretName: httpbin
   routes:
   - services:
     - name: httpbin
       port: 443
       protocol: tls

This will instruct Contour to terminate the incoming SSL/TLS with the specified hostname's certificate, and then initiate a new TLS connection to the upstream process specified by the service provided.