<p>According to <a href="https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs" rel="nofollow noreferrer">this page</a>, it appears Google Kubernetes can make a Google managed SSL certificate if you're using LoadBalancer. That's what I want to use.</p>
<p>However, I used <a href="https://cloud.google.com/kubernetes-engine/docs/tutorials/configuring-domain-name-static-ip" rel="nofollow noreferrer">this page</a> to set up an Ingress for my custom domain.</p>
<p>So right now, I have an Ingress and I can access my cluster using my custom domain just fine, but how do I add HTTPS to it? My suspicion is that Ingress also makes a LoadBalancer, but I can't figure out how to modify it according to the first link.</p>

<blockquote>
<p>My suspicion is that Ingress also makes a LoadBalancer, but I can't
figure out how to modify it according to the first link.</p>
</blockquote>
<p>You're right. When you create an <strong>ingress</strong> object, <strong>load balancer</strong> is created automatically, behind the scenes. It's even mentioned <a href="https://cloud.google.com/kubernetes-engine/docs/tutorials/configuring-domain-name-static-ip" rel="nofollow noreferrer">here</a>:</p>
<blockquote>
<p>If you choose to expose your application using an
<a href="https://cloud.google.com/kubernetes-engine/docs/concepts/ingress" rel="nofollow noreferrer">Ingress</a>,
which creates an HTTP(S) Load Balancer, you must <a href="https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address#reserve_new_static" rel="nofollow noreferrer">reserve a global
static IP
address</a>.</p>
</blockquote>
<p>You can even list it in your <strong>Google Cloud Console</strong> by goint to <code>Navigation menu</code> -&gt; <code>Networking</code> -&gt; <code>Network services</code> -&gt; <code>Load balancing</code>.</p>
<p>The easiest way to edit it is by clicking 3 dots next to it and then <code>Edit</code>:</p>
<p><a href="https://i.stack.imgur.com/fhxtT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/fhxtT.png" alt="enter image description here" /></a></p>
<p>But rather than editing it manually you need to modify your <code>Ingress</code> resource.</p>
<p>Suppose you have followed the steps outlined <a href="https://cloud.google.com/kubernetes-engine/docs/tutorials/configuring-domain-name-static-ip#step_2b_using_an_ingress" rel="nofollow noreferrer">here</a> and everything works as expected, but only via <strong>http</strong>, which is also expected as you have not configured <strong>SSL Certificate</strong> with your ingress so far and the <strong>Load Balancer</strong> it uses behind the scenes is also configured to work with http only.</p>
<p>If you followed <a href="https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs" rel="nofollow noreferrer">the guide you mentioned</a> and have already configured <strong>Google-managed SSL certificate</strong>, you only need to update your <strong>ingress</strong> resource configuration by adding <code>networking.gke.io/managed-certificates: certificate-name</code> annotation as @ldg suggested in his answer.</p>
<p>If you didn't configure your SSL certificate, you can do it from kubernetes level by applying the following yaml manifest as described <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs" rel="nofollow noreferrer">here</a>:</p>
<pre><code>apiVersion: networking.gke.io/v1beta2
kind: ManagedCertificate
metadata:
  name: example-cert
spec:
  domains:
    - example.com
</code></pre>
<p>Save it as file <code>example-cert.yaml</code> and then run:</p>
<pre><code>kubectl apply -f example-cert.yaml
</code></pre>
<p>Once it is created you can re-apply your <strong>ingress</strong> configuration from the same yaml manifest as before with the mentioned annotation added.</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: helloweb
  annotations:
    kubernetes.io/ingress.global-static-ip-name: helloweb-ip
    networking.gke.io/managed-certificates: example-cert ### 👈
  labels:
    app: hello
spec:
  backend:
    serviceName: helloweb-backend
    servicePort: 8080
</code></pre>
<p>If for some reason you want to get the ingress you've deployed based on your running configuration, you can run:</p>
<pre><code>kubectl get ingress helloweb -o yaml &gt; ingress.yaml
</code></pre>
<p>then you can edit the <code>ingress.yaml</code> file and re-apply it again.</p>
<p>After adding the annotation, go again in your <strong>Google Cloud Console</strong> to <code>Navigation menu</code> -&gt; <code>Networking</code> -&gt; <code>Network services</code> -&gt; <code>Load balancing</code> and you'll notice that the <strong>protocol</strong> of the <strong>load balancer</strong> associated with the ingress have changed from <code>HTTP</code> to <code>HTTP(S)</code> and if the certificate is valid, you should be able to access your website using your custom domain via HTTPS.</p>
