TLS1.3 TLS resumption seems not work with ssl-session-ticket-key

Author: sebglonCreated Mar 2, 2026Updated Mar 2, 2026

Labelskind/bugneeds-triageneeds-priority

What happened:

We need to enable the TSL resumption on cross pod. We have added this config on the configmap:

        ssl-session-ticket-key: <my_key>
        ssl-session-tickets: "true"
        ssl-session-timeout: 4h

When i test with only one pod, the ssl session is well reused. But not on cross-pod.

All pods share the same key, and the same config.

What you expected to happen: We need to reuse the same TLS cross-pods

NGINX Ingress controller version (exec into the pod and run /nginx-ingress-controller --version):

bash

POD_NAMESPACE=ingress-nginx
POD_NAME=$(kubectl get pods -n $POD_NAMESPACE -l app.kubernetes.io/name=ingress-nginx --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}')

kubectl exec -it $POD_NAME -n $POD_NAMESPACE -- /nginx-ingress-controller --version
-------------------------------------------------------------------------------
NGINX Ingress controller
  Release:       v1.14.3
  Build:         b4ab41015421ae27f3a96d73f013183b7e166735
  Repository:    https://github.com/kubernetes/ingress-nginx
  nginx version: nginx/1.27.1

-------------------------------------------------------------------------------
```

**Kubernetes version** (use `kubectl version`):
kubectl version
Client Version: v1.35.1
Kustomize Version: v5.7.1
Server Version: v1.30.14
Warning: version difference between client (1.35) and server (1.30) exceeds the supported minor version skew of +/-1

**Environment**:

- **Cloud provider or hardware configuration**: Outscale
- **OS** (e.g. from /etc/os-release): 
- **Kernel** (e.g. `uname -a`):
- **Install tools**:
  - `Please mention how/where was the cluster created like kubeadm/kops/minikube/kind etc. `
- **Basic cluster related info**:
  - `kubectl version`
  - `kubectl get nodes -o wide`

**How to reproduce this issue**:
Simply try to deploy the help chart with the default config and add this config:

```
     config:
        annotations-risk-level: Critical
        compute-full-forwarded-for: "false"
        keep-alive: "300"
        log-format-upstream: '{"nginx-ingress.time": "$time_iso8601", "nginx-ingress.remote_addr":
          "nginx-ingress.remote_user_ssl_dn": "$ssl_client_s_dn", "nginx-ingress.remote_user_ssl_exp":
          "$ssl_client_v_end", "nginx-ingress.remote_user_ssl_verify": "$ssl_client_verify",
          "nginx-ingress.bytes_sent": $bytes_sent, "nginx-ingress.request_time": $request_time,
          "nginx-ingress.status": $status, "nginx-ingress.vhost": "$host", "nginx-ingress.request_proto":
          "$server_protocol", "nginx-ingress.path": "$uri", "nginx-ingress.request_query":
          "$args", "nginx-ingress.request_length": $request_length, "nginx-ingress.duration":
          $request_time,"nginx-ingress.method": "$request_method", "nginx-ingress.http_referrer":
          "$http_referer", "nginx-ingress.http_user_agent": "$http_user_agent", "message":
          "$request - $status"}'
        proxy-set-headers: ingress-nginx/custom-headers
        real-ip-header: proxy_protocol
        session_id_context: cko-idv-nginx
        set-real-ip-from: 10.100.0.0/16
        ssl-ciphers: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
        ssl-session-cache: "true"
        ssl-session-ticket-key: <hardocded key>
        ssl-session-tickets: "true"
        ssl-session-timeout: 4h
        use-forwarded-headers: "true"
        use-proxy-protocol: "true"
```

Source: kubernetes/ingress-nginx

View original on GitHub View discussion on GitHub