<p>On Google Kubernetes Engine (GKE) you can use the <code>cloud.google.com/app-protocols</code> annotation on a Service to specify what protocol is used on that port (HTTP or HTTPS) <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/ingress-xlb#https_tls_between_load_balancer_and_your_application" rel="nofollow noreferrer">docs</a></p>
<p>When you create an External HTTP(S) Ingress, it will use this protocol between the Ingress and the Service.</p>
<p>How do I set things up so that the Service uses a certificate that is actually trusted by the Ingress?</p>
<p>Does it just trust any certificate signed by the <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-trust" rel="nofollow noreferrer">Cluster Root CA</a>? <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/#create-a-certificate-signing-request" rel="nofollow noreferrer">Manage tls in a cluster</a> suggests you need to include the pod IP address in the CSR - does that mean generating the CSR and waiting for the signed certificate to be created should be part of my container startup process?</p>

<p>Turns out when the &quot;GKE Ingress for HTTP(S) Load Balancing&quot; uses HTTPS to connect to the service, it accepts <em>any</em> certificate valid (even a self-signed one), without further configuration.</p>
<p>Apparently it does not use TLS to protect against MITM attacks here (which I guess might be reasonable).</p>
