<p>I am using an Ingress using Google-managed SSL certs mostly similar to what is described here:</p>
<p><a href="https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#setting_up_a_google-managed_certificate" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#setting_up_a_google-managed_certificate</a></p>
<p>However my backend service is a grpc service that is using HTTP2. According to the same documentation if I am using HTTP2 my backend needs to be <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-http2#creating_the_deployment" rel="nofollow noreferrer">&quot;configured with SSL&quot;.</a></p>
<p>This sounds like I need a separate set of certificates for my backend service to configure it with SSL.</p>
<p>Is there a way to use the same Google managed certs here as well?</p>
<p>What are my other options here? I am using, Google managed certs for the Ingress not to manage any certs on my own, if I then use self signed certificates for my service, that kind of defeats the purpose.</p>

<p>i don't think it's required to create SSL for the backend services if you are terminating the HTTPS at <strong>LB</strong> level. You can attach your certs to at LB level and the backed-end will be HTTPS &gt; HTTP.</p>
<p>You might need to create <strong>SSL/TLS</strong> new cert in case there is diff version <code>ssl-protocols: TLSv1.2 TLSv1.3</code>, Cipher set in your ingress controller configmap which you are using <strong>Nginx ingress controller</strong>, <strong>Kong</strong> etc.</p>
<p>If you are looking for End to End <strong>HTTPS</strong> traffic definitely you <strong>need to create a cert</strong> for the <strong>backend service</strong>.</p>
<p>You can also create/manage the <strong>Managed certificate</strong> or <strong>Custom cert</strong> with <a href="https://cert-manager.io/" rel="nofollow noreferrer">Cert manager</a> the <strong>K8s secret</strong> and <strong>mount</strong> to deployment which will be used further by the <strong>service</strong>, in that case, no need to manage or create the certs. Ingress will <strong>passthrough</strong> the HTTPS request to service directly.</p>
<p>In this case, it will be an end-to-end <strong>HTTPS</strong> setup.</p>
<p><strong>Update</strong> :</p>
<blockquote>
<p>Note: To ensure the load balancer can make a correct HTTP2 request to
your backend, your backend must be configured with SSL. For more
information on what types of certificates are accepted, see Encryption
from the load balancer to the backends .&quot; end to end tls seems to be a
requirement for HTTP2</p>
</blockquote>
<p>This is my site <a href="https://findmeip.com" rel="nofollow noreferrer">https://findmeip.com</a> it's running on <strong>HTTP2</strong> and terminating the <strong>SSL/TLS</strong> at the Nginx level only.</p>
<p>Definitely, it's good to go with the suggested practice so you can use the <strong>ESP</strong> option from the Google, setting GKE ingress + ESP + grpc stack.</p>
<p><a href="https://cloud.google.com/endpoints/docs/openapi/specify-proxy-startup-options?hl=tr" rel="nofollow noreferrer">https://cloud.google.com/endpoints/docs/openapi/specify-proxy-startup-options?hl=tr</a></p>
<p>If not want to use <strong>ESP</strong> check above suggested :</p>
<blockquote>
<p>You can Mount Managed certificate to
deployment which will be used further by the service, in that case, no
need to manage or create the certs. In other words, cert-manager will create/manage/re-new SSL/TLS on behalf of you in K8s secret which will used by service.</p>
</blockquote>
