<p>We need a Kubernetes service that brings up an AWS Load Balancer that supports web-sockets, i.e. not the classic LB.
Support for the AWS NLB is in Alpha state - but seems to work well.</p>

<p>The issue we have is with setting the Listener to be TLS and not TCP and attach the ACM SSL Certificate correctly - something that works well with the Classic LB</p>

<p>The annotations we have in the <code>service.yml</code> are:</p>

<pre><code>      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: 'arn:aws:acm:{{ .Values.certificate.region }}:{{ .Values.certificate.aws_user_id }}:certificate/{{ .Values.certificate.id }}'
      service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy: "ELBSecurityPolicy-TLS-1-2-2017-01"
      service.beta.kubernetes.io/aws-load-balancer-type: "nlb
</code></pre>

<p>The result is:</p>

<pre><code>| Listener ID | Security Policy | SSL Certificate | Default Action |
| ---         | ---             | ---             | ---            |
| TCP: 443    | N/A             | N/A             | Forward to: k8s|
</code></pre>

<p>Expected:</p>

<pre><code>| Listener ID | Security Policy | SSL Certificate | Default Action |
| ---         | ---             | ---             | ---            |
| TLS: 443    | ELBSecurityPol..| f456ac87d0ed99..| Forward to: k8s|
</code></pre>

<p>You can use ingress nginx controller on kubernetes and indirectly it is also make load balancer but handling certificate Renewal with Cert manager will be so easy</p>

<p>So ingress with Cert manager will be best idea for SSL and TLS certificate on kubernetes </p>

<blockquote>
  <p><a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/ingress/</a></p>
</blockquote>

<p>For More details of tutorial sharing this link check it out</p>

<blockquote>
  <p><a href="https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes" rel="nofollow noreferrer">https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes</a></p>
</blockquote>
