NIFIs HTTPS requirements make running on k8s impossible- I'm probably misunderstanding it though

[#1]

I think I might just be misunderstanding something, because it seems like NIFI requires HTTPS for intra cluster communication and uses the SAME HTTPS channel for external UI and API access?

I'm expecting to have intra cluster communication be separate from my load balancer/ingress. Meaning the nodes communicate securely with each other but I can set the API and UI to HTTP so I can terminate that at my load balancer- this is very standard practice.

What I think I'm seeing is NIFI uses the same HTTPS channel for both internal and external communication? That can't be right because there is no way I'm registering all my NIFI nodes with a public DNS domain.

But this can't be the case right? I should be able to set just the end user API and UI to HTTP and use a self signed cert for intra-node communication.

I can't even seem to be able to just disable HTTPS entirely, nifi's config is poorly documented and disabling HTTPS seems to break everything. I have this on a secured cluster and because this is k8s I have network policies and myriad other features available to secure them.

Its weird there are specific k8s features for nifi (k8s native instead of zookeeper) but it still seems trapped in this legacy model where it expects me to have a pet server for each node and manage them all manually.

[#2]

Hello @red888, 

Thanks for reaching Cloudera Community, glad to have you here. 

NiFi does not support HTTPS and HTTP mixed, you will need to have only one. 
Is recommended HTTPS, HTTP is supported but in the newer versions due to all the security, login auth and more, is not the best idea as you will face issues like you have seen. 

NiFi will use the same HTTPS listner to communicate, this is used for the UI, REST API and node protocol traffic. All of these are HTTPS requests. 

About the names, you do not need to add public DNS names. The certs only need to have the SANs matching what the nodes uses to talk each other. 
In K8s is usually the pods DNS or service DNS. 

There is no much NiFi docs for K8s, but some are these: 
https://nifi.apache.org/nifi-docs/administration-guide.html#kubernetes-clustering 
https://nifi.apache.org/nifi-docs/administration-guide.html#kubernetes-configmap-cluster-state-provi... 
https://nifi.apache.org/nifi-docs/administration-guide.html#kubernetes-nginx-ingress-controller 
https://nifi.apache.org/nifi-docs/administration-guide.html#cluster_node_properties  

[#3]

@red888 How are you deploying nifi on k8s now?   I am using our operators and deploying nifi w/ ssl is super easy!!