I am using EKS/Fargate for K8s deployment and using AWS Load Balancer Controller. There are few use cases which needs to support mutual authentication. In my opinion mutual authentication is not supported in ALB rather in the AWS Gateway. Even though the Gateway support it there is a limitation that it cannot be used as individual cert per API. Hence I am looking at options to offload TLS in ALB and pass the certificate to backend for mutual authentication. Looking for a similar option like in Nginx controller as stated here.
Here is the annotation.
nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream
Also I am aware that this can be directly done in the POD level with TLS termination if we use a NLB. However we enforces certain WAF rules from AWS which is not available to have in layer 4. Hence kindly looking for your input. Not sure such a feature is planned with ALB controller in the future.