<p>I'm Running a Kubernetes cluster on <code>AWS</code> using <code>Kops</code> for the first time and I need some help in exposing the services to the public with an AWS managed domain name and an SSL certificate. </p>

<p>The cluster is running in a private VPC and I can access it through a bastion instance.</p>

<p>Right now I'm exposing the services to the public using LoadBalancer service type as follow:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: my-gateway-service
  namespace: {{ .Values.nameSpace }}
  labels:
    app: gateway
    tier: backend
  annotations:
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: 'http'
      service.beta.kubernetes.io/aws-load-balancer-ssl-port: '{{ .Values.services.sslPort }}'
      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: '{{ .Values.services.sslCert }}'
spec:
  type: LoadBalancer
  selector:
    app: gateway
    tier: backend
  ports:
  - name: http
    port: 80
    targetPort: {{ .Values.applications.nodeAppPort }}
  - name: https
    port: 443
    targetPort: {{ .Values.applications.nodeAppPort }}
</code></pre>

<p>as you can see I'm passing the SSL certificate using annotations then I will just point the domain name to loadBalancer public ingress and done.</p>

<p><strong>The Problem:</strong>
This Project is a micro-services project and requires a lot of services to be exposed to the public in different environments which means a lot of <code>AWS LoadBalancers</code> and a lot of Money $$$$.</p>

<p>I've tried NodePort and ExternalName services but none of them worked because of the private VPC.</p>

<p>Any suggestions to overcome this problem?</p>

Adel Bachene
<p>To solve this, you can point your <code>LoadBalancer</code> to a "reverse-proxy" service such as an NGINX instance or Istio's Gateway (<a href="https://istio.io/docs/reference/config/istio.networking.v1alpha3/#Gateway" rel="nofollow noreferrer">https://istio.io/docs/reference/config/istio.networking.v1alpha3/#Gateway</a>), the Ingress controller and other options.</p>

<p>That way when you hit <code>https://[your_service_url]/[path]</code> you can build rules which route to the correct internal service in Kubernetes based on the actual values of <code>your_service_url</code> or <code>path</code>.</p>

<p>That way you only pay for 1 Load Balancer, but can host many services in the cluster.</p>
