Exposing HTTPS services with self-signed certs and mutual TLS

It seems to me that mutual TLS is currently impossible when exposing an HTTPS service: there is an HTTPS proxy in front of the service with a LE cert.

Use case: exposing Kubernetes clusters using mutual TLS auth.