CODEWITHSUNDEEP
amazon-web-serviceskubernetesamazon-elb
Maxime Coulombe
Maxime Coulombe

Reputation: 41

Creating a AWS ELB serving http and https with Kubernetes

I'm trying to create an AWS ELB through a kubernetes Service of type LoadBalancer and I can't figure out the combination of annotations needed to achieve the result I need.

This is the closest I can get: AWS ELB generated when deploying the yaml below

Using this service definition:

kind: Service
apiVersion: v1
metadata:
  name: my_app
  namespace: my_namespace
  labels:
    dns: route53
  annotations:
    domainName: my_app.my.domain.com
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: https
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:iam::accountId:server-certificate/CertificateName"
    service.beta.kubernetes.io/aws-load-balancer-internal: 0.0.0.0/0
spec:
  type: LoadBalancer
  selector:
    app: my_app
    version: my_version
  ports:
    - protocol: TCP
      port: 80
      targetPort: non_secure_port_name
      name: http
    - protocol: TCP
      port: 443
      targetPort: secure_port_name
      name: https

The problem is that I'd need the instance protocol for the https port to be https as well, like this

By editing the ELB manually, everything works like a charm but I'd like to be able to achieve the configuration in the 2nd picture through the .yaml configuration of my Kubernetes Service so no manual tweaks are needed for my services to work as expected when deployed.

Is it possible? What annotation or particular configuration am I missing?

Upvotes: 4

Views: 1165

Answers (1)

Lev Kuznetsov
Lev Kuznetsov

Reputation: 3728

Here's the incantation for terminating TLS at ELB using the AWS cert

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:foo
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: https
  labels:
    k8s-addon: ingress-nginx.addons.k8s.io
  name: ingress-nginx
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: http
  - name: https
    port: 443
    protocol: TCP
    targetPort: http
  selector:
    app: ingress-nginx
  type: LoadBalancer

If you want to force SSL you do that at the ingress resource definition with ingress.kubernetes.io/ssl-redirect annotation

Upvotes: 2

Related Questions