<p>A Python based <code>Flask</code> HTTP server is running on Google Kubernetes cluster as <code>Docker</code> container. It is implemented as a single pod <code>flask-http-deployment</code> and placed behind a <code>Load Balancer</code>.</p>

<p>The HTTP server's Python code is quite simple and does not support <code>HTTPS</code> protocol. But other applications will need to communicate with this server via HTTPS. So there is a need to implement a support for <code>HTTPS</code>.</p>

<p>From what I read (please correct me if I am wrong), the <code>HTTPS</code> support could be implemented by configuring the <code>flask-http-deployment</code> with a <code>secret</code>.</p>

<p>Here are the steps I followed:</p>

<ol>
<li>Generated the <code>my-cert.crt</code> and <code>my-key.key</code> files:</li>
</ol>

<p><code>openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout my-key.key -out my-cert.crt -subj '//CN=mydomain.com'</code></p>

<ol start="2">
<li>With <code>my-cert.crt</code> and <code>my-key.key</code> files in place I created Kubernetes <code>secret</code>:</li>
</ol>

<p><code>kubectl create secret tls my-secret --key=my-key.key --cert=y-cert.crt</code></p>

<p>How should I now modify the <code>flask-http-deployment</code> yaml file with a <code>secret</code> I've just created?</p>

<pre><code>      apiVersion: extensions/v1beta1
      kind: Deployment
      metadata:
        name: flask-http-deployment
      spec:
        replicas: 5
        minReadySeconds: 10
        strategy:
          type: RollingUpdate
          rollingUpdate:
            maxUnavailable: 1
            maxSurge: 1
        template:
          metadata:
            labels:
              app: flask-http-app
          spec:
            containers:
            - name: flask-http-container
              image: gcr.io/my-project-id/flask-http-container
              ports:
              - containerPort: 80
              imagePullPolicy: IfNotPresent

</code></pre>

<p>Here is the Load Balancer yaml, in case it is needed:</p>

<pre><code>  apiVersion: v1
  kind: Service
  metadata:
    name: flask-http-load-balancer
    labels:
      app: flask-http-app
  spec:
    type: LoadBalancer
    ports:
    - port: 80
      nodePort: 30000
      protocol: TCP
      name: flask 
    selector:
</code></pre>

<p>I am not sure about the secret , and where are you using the secret that you created , but supporting https is the same as in traditional world , put an https termination proxy in front of your app service , such as an nginx pod or an nginx ingress controller ( use your secret in there )</p>

<p>or terminate SSL/TLS in your external load balancer.</p>
