<p>We are using Kubernetes v1.19.13 hosted on Google Kubernetes Engine. We want to configure an Ingress controller so that the Google HTTP(S) LoadBalancer is configured to allow only TLS 1.2 and 1.3 and these features/ciphers:</p>
<pre><code>TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
</code></pre>
<p>We would prefer to do this using annotations but most examples we have found uses a ConfigMap or FrontendConfig.</p>
<p>Is this possible to configure this using annotations? If not, what is the recommended way of achieving this?</p>
<p>Note that we want to configure this using Kubernetes and not using the Google Cloud Console.</p>

<p>You won't be able to do this using annotations.  You cannot currently create an SSL Policy via annotations.  SSL Policies need to be <a href="https://cloud.google.com/load-balancing/docs/use-ssl-policies#creating_ssl_policies" rel="nofollow noreferrer">created</a> via gcloud CLI or via the GCP API.</p>
<p>You'll then need to create a FrontendConfig resource which references the policy and then attach it to your ingress resource:</p>
<pre><code>apiVersion: networking.gke.io/v1beta1
kind: FrontendConfig
metadata:
  name: FRONTENDCONFIG_NAME
spec:
  sslPolicy: allowed-ciphers

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    networking.gke.io/v1beta1.FrontendConfig: &quot;FRONTENDCONFIG_NAME&quot;
...
</code></pre>
<p>The good news is that you can (re)use the SSL Policy and/or FrontendConfig.</p>
<p>If you want to do everything via the k8s API, you can try using <a href="https://cloud.google.com/config-connector/docs/overview" rel="nofollow noreferrer">Config Connector</a> and create <a href="https://cloud.google.com/config-connector/docs/reference/resource-docs/compute/computesslpolicy" rel="nofollow noreferrer">ComputeSSLPolicy</a> resource.</p>
