Authenticated origin pulls are the right extra hop when Full (strict) alone still leaves the origin IP reachable from the public internet. On ingress-nginx I mount the edge CA (or the pull client CA) into the controller, require client cert verify on the HTTPS listener that faces the CDN, and keep a separate internal Service path for in-cluster probes so kubelet health checks are not blocked by mTLS. Rotate the client cert on a calendar, not only at expiry, and stage the new CA alongside the old one before flipping verify.

Ops failure mode we keep hitting is “origin works from a laptop” after someone opens 443 to the world for debugging — mTLS then looks broken when it is actually bypassed. Lock security groups or NetworkPolicy to the CDN egress ranges, reject plaintext on the origin port, and alert on tls handshake failures plus 4xx from missing client certs. After deploy, confirm a request without the pull cert dies at the ingress while a normal edge request still reaches the pod; if both succeed, the verify path never engaged.