Answers: <p>The ConfigMap and Annotation configuration have different purposes.</p>
  <p>As per <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-protocols" rel="nofollow noreferrer">nginx-configuration/configmap/#ssl-protocols</a>:</p>
  <blockquote>
  <p>Sets the SSL <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols" rel="nofollow noreferrer">protocols</a> to use. The default is: TLSv1.2 TLSv1.3</p>
  <p>ngx_http_ssl_module.html#ssl_protocols<br />
  Context:  http, server</p>
  </blockquote>
  <p>i.e., enable the specified protocols <strong>to your Nginx Controller</strong>.</p>
  <p><code>client --ssl-protocols-&gt; controller --&gt; backend</code></p>
  <hr />
  <p>On <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#backend-certificate-authentication" rel="nofollow noreferrer">nginx-configuration/annotations/#backend-certificate-authentication</a>, we can read:</p>
  <blockquote>
  <p>Enables the specified <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_protocols" rel="nofollow noreferrer">protocols</a> for requests to a proxied HTTPS server.</p>
  <p>ngx_http_proxy_module.html#proxy_ssl_protocols
  http, server, location</p>
  </blockquote>
  <p>i.e., enables the specified protocols for requests <strong>to a <a href="https://docs.nginx.com/nginx/admin-guide/security-controls/securing-http-traffic-upstream/" rel="nofollow noreferrer">proxied backend</a> using HTTPS</strong>.</p>
  <p><code>client --&gt; controller --proxy-ssl-protocols-&gt; backend</code></p>
  <hr />
  <p>As you can see, to set the protocols served by your Nginx controller, you only have <code>http, server</code> contexts available (i.e., you can't set this to specific ingress objects).</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-04-14T13:34:00.853Z
Answers: 2021-04-14T13:34:00.853Z
Answers: Eduardo Baitello
Body: <p>I try to enable TLSv1 and TLSv1.1 for one specific ingress on a AKS cluster.</p>
  <p>By default, only TLSv1.2 is enabled.</p>
  <p>I don't want to apply this configuration on my all cluster, just on a specific webserver service.</p>
  <p>Regarding the documentation, I need to add this annotation if I don't want to change nginx config by ConfigMap :</p>
  <p><code>nginx.ingress.kubernetes.io/proxy-ssl-protocols: TLSv1 TLSv1.1 TLSv1.2</code></p>
  <p>but this has no effect.</p>
  <p>Is it really possible to do this by annotation ?</p>
  <p>Did I do something wrong ?</p>
  <p>Thank you !</p>
  
Comments: CC BY-SA 4.0
Comments: 2021-04-12T18:08:45.193Z
Comments: Which image/tag of the ingress controller are you using?
Comments: Eduardo Baitello
Comments: CC BY-SA 4.0
Comments: 2021-04-14T07:41:08.433Z
Comments: @EduardoBaitello I use this one : gcr.io/jenkinsxio/nginx-ingress-controller:0.30.0
  Thanks for your reply !
Comments: benCat
Tags: <kubernetes><nginx><ingress><azure-kubernetes-service>
Title: Enable TLSv1 TLSv1.1 for specific Ingress with Nginx Ingress
UserDisplayName: benCat
ThreadText: # Enable TLSv1 TLSv1.1 for specific Ingress with Nginx Ingress
  
  (Asked by: username_0 on 2021-04-12)
  
  I try to enable TLSv1 and TLSv1.1 for one specific ingress on a AKS cluster.
  
  By default, only TLSv1.2 is enabled.
  
  I don't want to apply this configuration on my all cluster, just on a specific webserver service.
  
  Regarding the documentation, I need to add this annotation if I don't want to change nginx config by ConfigMap :
  
  `nginx.ingress.kubernetes.io/proxy-ssl-protocols: TLSv1 TLSv1.1 TLSv1.2`
  
  but this has no effect.
  
  Is it really possible to do this by annotation ?
  
  Did I do something wrong ?
  
  Thank you !
  
  **Tags:** kubernetes, nginx, ingress, azure-kubernetes-service
  
  > **Comments:**
  > **username_1**: Which image/tag of the ingress controller are you using?  
  > **username_0**: @username_1 I use this one : gcr.io/jenkinsxio/nginx-ingress-controller:0.30.0 Thanks for your reply !  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-04-14. Score: 2
  
  The ConfigMap and Annotation configuration have different purposes.
  
  As per [nginx-configuration/configmap/#ssl-protocols](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-protocols):
  
  > Sets the SSL [protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) to use. The default is: TLSv1.2 TLSv1.3
  >
  > ngx\_http\_ssl\_module.html#ssl\_protocols  
  > Context: http, server
  
  i.e., enable the specified protocols **to your Nginx Controller**.
  
  `client --ssl-protocols-> controller --> backend`
  
  ---
  
  On [nginx-configuration/annotations/#backend-certificate-authentication](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#backend-certificate-authentication), we can read:
  
  > Enables the specified [protocols](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_protocols) for requests to a proxied HTTPS server.
  >
  > ngx\_http\_proxy\_module.html#proxy\_ssl\_protocols
  > http, server, location
  
  i.e., enables the specified protocols for requests **to a [proxied backend](https://docs.nginx.com/nginx/admin-guide/security-controls/securing-http-traffic-upstream/) using HTTPS**.
  
  `client --> controller --proxy-ssl-protocols-> backend`
  
  ---
  
  As you can see, to set the protocols served by your Nginx controller, you only have `http, server` contexts available (i.e., you can't set this to specific ingress objects).
  
  
  ---
  
  