<h1>Issue</h1>

<p>I am having trouble applying TLS to the DNS name of my LoadBalancer service for my Kubernetes cluster, and I am at a bit of a loss.</p>

<p>This is the first time I have worked with Kubernetes as well as Azure's Manage Container Services. For reasons that are out of my control this api is required to run on Azure's Managed Container Services. </p>

<h1>Environment</h1>

<p>Cluster is running on Azure using Managed Container Services (preview). I created my environment by following the steps here:  <a href="https://learn.microsoft.com/en-us/azure/aks/tutorial-kubernetes-deploy-cluster" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/tutorial-kubernetes-deploy-cluster</a></p>

<p>I created a static IP in Azure to use in the yaml for the loadbalancer service. Furthermore, I created a <code>myprefix.cloudapp.azure.com</code> DNS name for the IP using the following commands (<a href="https://learn.microsoft.com/en-us/azure/aks/static-ip" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/static-ip</a>)</p>

<p><code>IP="XX.XX.XX.XX"</code></p>

<p><code>DNSNAME="myprefix"</code></p>

<p><code>RESOURCEGROUP=$(az network public-ip list --query "[?ipAddress!=null]|[?contains(ipAddress, '$IP')].[resourceGroup]" --output tsv)</code></p>

<p><code>PIPNAME=$(az network public-ip list --query "[?ipAddress!=null]|[?contains(ipAddress, '$IP')].[name]" --output tsv)</code></p>

<p><code>az network public-ip update --resource-group $RESOURCEGROUP --name  $PIPNAME --dns-name $DNSNAME</code></p>

<h1>Deployment</h1>

<p>This is the yaml I am using for my deployment:</p>

<p><code>apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: my-node-express-api-deployment
spec:
  replicas: 2
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
  minReadySeconds: 5
  template:
    metadata:
      labels:
        app: my-node-express-api
    spec:
      containers:
      - name: my-node-express-api-container
        image: myrepo/my-node-express-api-image:latest
        ports:
        - containerPort: 3000
      volumes:
      - name: tls
        secret:
          secretName: my-tls-secret</code></p>

<h1>Service</h1>

<p>This is the yaml for my LoadBalancing Service</p>

<p><code>apiVersion: v1
kind: Service
metadata:
  name: my-node-express-api-loadbalancer
spec:
  loadBalancerIP: 52.176.148.91
  type: LoadBalancer
  ports:
  - port: 80
    targetPort: 3000
    port: 443
    targetPort: 3000
  selector:
    app: my-node-express-api</code></p>

<h1>Secret</h1>

<p>Yaml for secret</p>

<p><code>apiVersion: v1
kind: Secret
metadata:
  name: my-tls-secret
  namespace: default
data:
  tls.crt: (base64 for myprefix.cloudapp.azure.com.crt)
  tls.key: (base64 for myprefix.cloudapp.azure.com.key)</code></p>

<h1>Note:</h1>

<p>Everything works correctly over http when I remove the Secret from my deployment and remove port 443 from the LoadBalancer Service.</p>

<p>On Azure, if you need TLS termination on kubernetes, you can use <strong>Nginx Ingress controller</strong>(Now, Microsoft working with Azure ingress controller which uses Application gateway).</p>

<p>To archive this, we can follow those steps:<br>
1 Deploy the Nginx Ingress controller<br>
2 Create TLS certificates<br>
3 Deploy test http service<br>
4 configure TLS termination  </p>

<p>More information about configure Nginx ingress controller for TLS termination on kubernetes on Azure, please refer to this <a href="https://blogs.technet.microsoft.com/livedevopsinjapan/2017/02/28/configure-nginx-ingress-controller-for-tls-termination-on-kubernetes-on-azure-2/" rel="nofollow noreferrer">blog</a>.</p>
