<p>I have a Google Kubernetes Engine with an application that has a public service endpoint. But I would like to change the endpoint from http://... to a secure https://. </p>

<p>What is the easiest way of going about this?</p>

<p>I assume I will need to somehow get an entity to issue me some sort of certificate for my domain. If that's the case, should I use the 35.X.X.X endpoint IP or use a domain such as mydomain.com?</p>

<p>Thanks</p>

<p>There are multiple ways of doing this. Here are some:</p>

<ol>
<li>An easy way is to create external layer 7 GCP load balancer and have it terminate your SSL, with your own certificates, then create a <code>NodePort</code> service to listen for your traffic (non-TLS) and forward the layer 7 load balancer to that <code>NodePort</code> on all your cluster machines. The downside of this solution would be that your internal cluster traffic would be non-TLS, but you may not care about that unless you are implementing compliance.</li>
</ol>

<p><a href="https://i.stack.imgur.com/9L5an.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/9L5an.png" alt="LB"></a></p>

<ol start="2">
<li><p>Another way is to just let your application in the pod handle SSL directly and set the pod to listen on port 443 and expose it on your layer 4 GCP load balancer on port 443.</p></li>
<li><p>Another way (which is preferred on later Kubernetes versions) is to use the same <code>35.X.X.X</code> external IP which essentially is a layer 4 load balancer and have a <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Kubernetes Ingress</a> listen for your traffic and handle <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#tls" rel="nofollow noreferrer">TLS</a>. </p></li>
</ol>

<p>Note that this all gets a bit trickier if you want to implement TLS end to end.</p>
