In a microservices scenario, each web-api container should serve itself through HTTPS or is it ok to internally work through HTTP and have all ingresses configured with certificates and redirecting to port 80 of the containers?
I think the easiest approach is to protect only the outside traffic, because to configure an Asp.Net Core WebAPI to serve itself (kestrel) through HTTPS (for example) you have to mount the certificate in a volume and provide the certificate password. It's a little bit complicated.
What is the best practice?