My web server backend enforces a client-side certificate. This worked great until I moved my deployment to a Kubernetes cluster. My guess is that the forwarding rules are not passing on the certificate request from the server to the browser.

I'm using uwsgi-nginx-flask-docker container.

My Nginx configuration is as follows:

server {
    listen 8000 ssl;
    location / {
        try_files $uri @app;
    }
    location @app {
        include uwsgi_params; uwsgi_param SSL_CLIENT_S_DN $ssl_client_s_dn;

        uwsgi_pass unix:///tmp/uwsgi.sock;
        uwsgi_read_timeout 300;

        ssl_certificate     /app/cert.pem;
        ssl_certificate_key /app/key.pem;
        ssl_password_file   /app/password.pass;

        ssl_client_certificate  /app/client-ca.crt;
        ssl_verify_client off;
        ssl_verify_depth 2;
    }
    location /static {
        alias /app/static;
    }
}

When deploying this server on a local container, I'm getting SSL_CLIENT_S_DN in flask.request.environ, as expected.

On my Kubernetes cluster, the variable is just empty and no certificate demand is popped on the browser.

My service and deployment:

apiVersion: v1
kind: Service
metadata:
  name: my-server
spec:
  selector:
    app: my-server
  type: LoadBalancer
  loadBalancerIP: XX.XX.XXX.XXX
  ports:

  - protocol: TCP
    port: 8000
    targetPort: 8000

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-server
  labels:
    app: my-server
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
  selector:
    matchLabels:
      app: my-server
  template:
    metadata:
      labels:
        app: my-server
    spec:
      restartPolicy: Always
      hostname: my-server
      containers:

      - name: my-server
        image: asia.gcr.io/my-project/my-server:latest
        imagePullPolicy: Always
        ports:
        - name: LISTEN_PORT
          value: "8000 ssl"