<p>What I am trying to do, is to deploy an API on Kubernetes and, using Google-managed SSL certificates, redirect it to point on my domain on HTTPS protocol.</p>
<p>I have already spent some time on it and done a lot of debugging, but there is one thing that I can't succeed to fix.</p>
<p>What is already done and works:</p>
<ul>
<li>Static IP is reserved</li>
<li>Google-managed SSL certificate is Active and verified</li>
<li>Both Ingress and Service NodePort are deployed using <strong>443 HTTPS protocol</strong>.</li>
<li>Health Checks I managed to put on HTTPS as well.</li>
</ul>
<p>Problem:</p>
<ul>
<li>I cannot change the default configuration for loadbalancer backend service. It is always on HTTP.</li>
</ul>
<p><a href="https://i.stack.imgur.com/vFFXy.png" rel="nofollow noreferrer">Problematic place</a></p>
<p><strong>BUT</strong> if I change it manually to HTTPS, <strong>API works as expected on my domain</strong> <em>api.mydomain.com</em>. The problem is that in 5 minutes, the default configurations are sync with the current configuration in K8s, and the protocol changes to HTTP automatically.</p>
<p>My question: how can set a default configuration to HTTPS for backend service which will not be overwritten afterward.</p>
<p>Here is the guide that I partially followed:</p>
<p><a href="https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#console" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#console</a></p>
<p>And my configurations for Ingress, Service and Health Check</p>
<p><strong>healthcheck.yaml</strong></p>
<pre><code>apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: api-default-config
spec:
  healthCheck:
    checkIntervalSec: 60
    timeoutSec: 60
    healthyThreshold: 1
    unhealthyThreshold: 10
    type: HTTPS
    requestPath: /
    port: 31303
</code></pre>
<p><strong>service.yaml</strong></p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: management-api-test-service
  annotations:
    cloud.google.com/backend-config: '{&quot;default&quot;: &quot;api-default-config&quot;}'
spec:
  type: NodePort
  selector:
    app: management-api-test
    environment: test
  ports:
  - protocol: TCP
    port: 443
    targetPort: 5000
    nodePort: 31303
</code></pre>
<p><strong>ingress.yaml</strong></p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: api-test2
    networking.gke.io/managed-certificates: test-cert
    kubernetes.io/ingress.class: &quot;gce&quot;
    kubernetes.io/ingress.allow-http: &quot;false&quot;
spec:
  defaultBackend:
    service:
      name: management-api-test-service
      port:
        number: 443
  rules:
  - host: api.mydomain.com
    http:
      paths:
      - path: /*
        pathType: ImplementationSpecific
        backend:
          service:
            name: management-api-test-service
            port:
              number: 443
</code></pre>
<p><strong>kubectl describe svc management-api-test-service -n web-application</strong></p>
<pre><code>Name:                     management-api-test-service
Namespace:                web-application
Labels:                   &lt;none&gt;
Annotations:              cloud.google.com/backend-config: {&quot;default&quot;: &quot;api-default-config&quot;}
Selector:                 app=management-api-test,environment=test
Type:                     NodePort
IP Families:              &lt;none&gt;
IP:                       **.***.**.130
IPs:                      &lt;none&gt;
Port:                     &lt;unset&gt;  443/TCP
TargetPort:               5000/TCP
NodePort:                 &lt;unset&gt;  31303/TCP
Endpoints:                **.***.*.13:5000
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   &lt;none&gt;
</code></pre>
<p><strong>kubectl describe ingress api-ingress  -n web-application</strong></p>
<pre><code>Name:             api-ingress
Namespace:        web-application
Address:          **.***.***.196
Default backend:  management-api-test-service:443 (***.**.**.13:5000)
Rules:
  Host                    Path  Backends
  ----                    ----  --------
  api.mydomain.com
                          /*   management-api-test-service:443 (***.**.**.13:5000)
Annotations:              ingress.gcp.kubernetes.io/pre-shared-cert: mcrt-blablabla
                          ingress.kubernetes.io/backends: {&quot;k8s-be-31303--efb221b572e568cb&quot;:&quot;HEALTHY&quot;}
                          ingress.kubernetes.io/https-forwarding-rule: k8s2-fs-1xka7p8q-web-application-api-ingress-5jc6y1ty
                          ingress.kubernetes.io/https-target-proxy: k8s2-ts-1xka7p8q-web-application-api-ingress-5jc6y1ty
                          ingress.kubernetes.io/ssl-cert: mcrt-blablabla
                          ingress.kubernetes.io/url-map: k8s2-um-1xka7p8q-web-application-api-ingress-5jc6y1ty
                          kubernetes.io/ingress.allow-http: false
                          kubernetes.io/ingress.class: gce
                          kubernetes.io/ingress.global-static-ip-name: api-test2
                          networking.gke.io/managed-certificates: test-cert
Events:
  Type    Reason  Age                   From                     Message
  ----    ------  ----                  ----                     -------
  Normal  Sync    5m2s (x22 over 155m)  loadbalancer-controller  Scheduled for sync
</code></pre>
<p><strong>I TRIED</strong>:</p>
<ul>
<li><code>kubernetes.io/ingress.allow-http: false</code> changes nothing</li>
<li>some configuration with nginx, where http set to &quot;false&quot;, but I cannot find it and it did not work.</li>
</ul>
<p><strong>Thanks in advance!</strong></p>

<p>Found it!!!</p>
<p>In the <strong>service.yaml</strong> in the annotations had to add another config and attribute a name to my port. Here is a new config</p>
<p><strong>service.yaml</strong></p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: management-api-test-service
  annotations:
    cloud.google.com/backend-config: '{&quot;default&quot;: &quot;api-default-config&quot;}'
    cloud.google.com/app-protocols: '{&quot;my-https-port&quot;:&quot;HTTPS&quot;}' # new line
spec:
  type: NodePort
  selector:
    app: management-api-test
    environment: test
  ports:
  - name: my-https-port # add port name
    protocol: TCP
    port: 443
    targetPort: 5000
    nodePort: 31303
</code></pre>
