Nginx to Kubernetes TLS Enforcement

I need end-to-end TLS enforced between my internet-facing Nginx reverse proxy and the API service running inside a Kubernetes pod. The service is already exposed over HTTPS and uses a certificate issued by a trusted CA, but right now encryption is terminated at the proxy; traffic from Nginx to the pod still rides plain HTTP.

The task is to adjust the Nginx and Kubernetes manifests so that:
• Nginx re-encrypts (or directly passes) requests to the pod over HTTPS only.
• The existing trusted-CA certificate chain is presented without breaking current clients.
• Health checks and readiness probes keep working after the switch.

I’ll grant access to the current Nginx configuration, the deployment YAMLs, and a staging cluster so you can test safely. A concise set of updated configs plus step-by-step notes for reproducing the setup in production will be the final deliverable.