Which ingress controller should I use for end-to-end TLS on EKS, AKS, or GKE?

First pin down what compliance means by end-to-end. With AWS Load Balancer Controller, you can configure the ALB target group to use HTTPS to the pods. That encrypts both hops, but the ALB terminates the client connection and doesn't validate the backend certificate, so it isn't authenticated backend TLS.

If that's not enough, one option is an NLB passing TLS through to a gateway in the cluster. The gateway then terminates TLS, so check what authentication and encryption you need between that gateway and the application too. Don't assume passthrough alone covers every hop.

Take a look at Envoy Gateway. It gives you an in-cluster gateway option if you want more control over where TLS terminates than an ALB provides. Check its backend TLS configuration against your certificate validation and workload identity requirements before choosing it.

Istio is worth considering if the requirement extends beyond ingress to authenticated traffic between workloads. Strict mutual TLS can help there, though it adds a service mesh to operate. You would still need to design the external load balancer and gateway path rather than assuming the mesh covers it automatically.

For a Gateway API option, Traefik is another controller to evaluate. Check whether its TLS termination and backend certificate verification settings fit the compliance requirement. The controller name alone won't tell you whether every hop is authenticated.

The familiar choice varies by cloud. AWS Load Balancer Controller is common on EKS. On AKS, consider Application Gateway for Containers for a new deployment, unless a needed feature is missing. GKE has its own Ingress and Gateway options. Compare their TLS behavior rather than picking based only on popularity.