Do: https://github.com/kubernetes/kubernetes/blob/master/pkg/apis/extensions/v1beta1/types.go#L695
most importantly, https to backend because the customer doesn't have clarity into where exactly a CP is terminating their connection, and obviously no one wants to terminate in some other continent and go over the internet via http because sometimes governments do weird things with http exit traffic.