<p>I am setting a couple of services running on Google Container Engine, with traffic coming in through a Google HTTP Load Balancer, using path mapping.</p>

<p>There is a good Google tutorial on setting up content-based load-balancing <a href="https://cloud.google.com/compute/docs/load-balancing/http/content-based-example" rel="nofollow">here</a>, but it is all in terms of plain Google Compute objects like instance groups and backend services. I, however, have Kubernetes services, pods and clusters.</p>

<p>What is the relationship between the Kubernetes objects and the Google Compute resources? How do I map between the two programmatically?</p>

<p>(I am aware that I could be using a Kubernetes web ingress object to do the balancing, as explained <a href="https://cloud.google.com/container-engine/docs/tutorials/http-balancer#step_3_create_an_ingress_object" rel="nofollow">here</a>, but it looks like Kubernetes Ingress does not yet support HTTPS, which need.) </p>

<blockquote>
  <p>What is the relationship between the Kubernetes objects and the Google Compute resources? How do I map between the two programmatically?</p>
</blockquote>

<p><a href="https://github.com/kubernetes/contrib/tree/master/Ingress/controllers/gce#overview" rel="nofollow">https://github.com/kubernetes/contrib/tree/master/Ingress/controllers/gce#overview</a></p>

<blockquote>
  <p>(I am aware that I could be using a Kubernetes web ingress object to do the balancing, as explained here, but it looks like Kubernetes Ingress does not yet support HTTPS, which need.)</p>
</blockquote>

<p>Ingress will support HTTPS in 1.2. This is what the resource will look like: <a href="https://github.com/kubernetes/kubernetes/issues/19497#issuecomment-174112834" rel="nofollow">https://github.com/kubernetes/kubernetes/issues/19497#issuecomment-174112834</a>. In the meanwhile you can setup HTTP loadbalancing with the Ingress and hand modify it to support https. Apologies beforehand that this is convoluted, it will get better soon. </p>

<p>First create an HTTP Ingress:</p>

<ol>
<li>Create Services of <a href="https://github.com/kubernetes/kubernetes/blob/release-1.1/docs/user-guide/services.md#type-nodeport" rel="nofollow">Type=NodePort</a></li>
<li>Make sure you have <a href="https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/cluster-loadbalancing/glbc#prerequisites" rel="nofollow">BackendService quota</a></li>
<li>Create a <a href="https://cloud.google.com/container-engine/docs/tutorials/http-balancer" rel="nofollow">HTTP Ingress</a></li>
<li>Expose the node port (s) of the service in the Firewall (also as mentioned in <a href="https://cloud.google.com/container-engine/docs/tutorials/http-balancer" rel="nofollow">https://cloud.google.com/container-engine/docs/tutorials/http-balancer</a>)</li>
<li>Wait till kubect describe ing shows <a href="https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/cluster-loadbalancing/glbc#latency" rel="nofollow">HEALTHY for you backends</a>.</li>
</ol>

<p>At this point you should be able to curl your Ingress loadbalancer IP and hit the nginx service (or whatever service you created in step 1).</p>

<p>Then do the following, manually through the <a href="https://console.developers.google.com" rel="nofollow">GCE console</a>: </p>

<ol>
<li>Change the IP of the Ingress resource from "Ephmermal" to "Static" (look for the IP in <code>kubectl get ing</code> in the "External IP addresses" tab)</li>
<li>Create your ssl cert. If you just want a self signed cert you can do: </li>
</ol>

<blockquote>
  <p>openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /tmp/nginx.key -out /tmp/nginx.crt -subj "/CN=nginxsvc/O=nginxsvc"</p>
</blockquote>

<ol start="3">
<li>Create a new target HTTPS proxy and forwarding rule for the HTTPS load balancer and assign it to the same (static) IP of the http load balancer.</li>
</ol>

<p>At this point you should be able to curl <a href="https://loadbalancer-ip" rel="nofollow">https://loadbalancer-ip</a> -k</p>
