<p>I have created a NodeJS application using http/2 following <a href="https://nodejs.org/api/http2.html#http2_compatibility_api" rel="nofollow noreferrer">this example</a>:</p>

<blockquote>
  <p>Note: this application uses self-signed certificate until now.</p>
</blockquote>

<p>We deployed it on GKE, and it is working until now.
Here is how this simple architecture looks like:</p>

<p><a href="https://i.stack.imgur.com/hXWsR.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/hXWsR.png" alt="enter image description here"></a></p>

<p>Now, we want to start using real certificate, and don`t know where is the right place to put it. </p>

<p>Should we put it in pod (overriding self-signed certificate)? </p>

<p>Should we add a proxy on the top of this architecture to put the certificate in?</p>

<p>In GKE you can use a <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/ingress" rel="nofollow noreferrer">ingress object</a> to routing external HTTP(S) traffic to your applications in your cluster. With this you have 3 options:</p>

<ul>
<li>Google-managed certificates</li>
<li>Self-managed certificates shared with GCP</li>
<li>Self-managed certificates as Secret resources</li>
</ul>

<p>Check <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/load-balance-ingress" rel="nofollow noreferrer">this guide</a> for the ingress load balancing</p>
