<p>We're currently trying to deploy Kong in a GKE cluster and the goal is to delegate the certificate management to Google's Load Balancer (the SSL termination should be made here).</p>
<p>The problem we faced is that all Google's documentation is focus on deploying some service and use their exclusive Load Balancer that connects directly to the Ingress declared.</p>
<p>The configuration which currently works (without Kong) is the following:</p>
<pre><code># values.yml (from Service X inside GKE, using Helm)
...
ingress:
  enabled: true
  hostname: example.com
  annotations:
    kubernetes.io/ingress.class: gce
    kubernetes.io/ingress.allow-http: &quot;false&quot;
    kubernetes.io/ingress.global-static-ip-name: example-static-ip
    ingress.gcp.kubernetes.io/pre-shared-cert: example-cert
...
</code></pre>
<p>However, when we change <code>gce</code> for <code>kong</code> as the ingress.class, all other annotations don't continue to work. This is expected, as now Kong's proxy is the one being the <em>Load Balancer</em> and should be the one that tells Google's LB how to generate itself.</p>
<p>According to this <a href="https://v1-18.docs.kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#aws" rel="nofollow noreferrer">documentation</a>, it should be fairly simple to add those annotations to Kong proxy service.</p>
<p>Based on this chain of events:</p>
<ul>
<li>K8s Ingress creates Kong proxy service</li>
<li>Kong proxy service generates Google's LB</li>
</ul>
<p>The configuration to customize the LB should be made inside Kong's service (as I understand):</p>
<pre><code># values.yml (Kong, using Helm)
...
proxy:
  type: LoadBalancer
  annotations: {} &lt;-- Here
  http:
    ...
  tls:
    ...
...
</code></pre>
<p>However, for GCP there are only a few according to the <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/load-balance-ingress#summary_of_external_ingress_annotations" rel="nofollow noreferrer">docs</a>, and none of them have the desire effect (cannot set certificate to use, define which type of LB to create, etc.)</p>
<p>All things into account, is there any way to achieve our main goal which would be:</p>
<p><em>&quot;Deploy Kong API Gateway through Helm inside GKE and delegate SSL termination to custom Google's LB.&quot;</em></p>

manuelnucci
<p><strong>TL;DR</strong></p>
<p><strong>Unfortunately there is no possibility to use Google Managed Certificates with Kong Ingress.</strong></p>
<p>To be exact Google Managed Certificates in <code>GKE</code> can be used <strong>only</strong> with:</p>
<ul>
<li>Ingress for External HTTP(S) Load Balancing</li>
</ul>
<p>As pointed by documentation:</p>
<blockquote>
<p><strong>Note:</strong> This feature is only available with Ingress for External HTTP(S) Load Balancing.</p>
<p>-- <em><a href="https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs" rel="nofollow noreferrer">Cloud.google.com: Kubernetes Engine: Docs: How to: Managed certs</a></em></p>
</blockquote>
<hr />
<hr />
<h3>Explanation</h3>
<p>According to the documentation (slightly modified):</p>
<blockquote>
<p>When you create an Ingress object with below class:</p>
<ul>
<li><code>kubernetes.io/ingress.class: gce</code></li>
</ul>
<p>the <a href="https://github.com/kubernetes/ingress-gce" rel="nofollow noreferrer">GKE Ingress</a> controller creates a <a href="https://cloud.google.com/load-balancing/docs/https" rel="nofollow noreferrer">Google Cloud HTTP(S) Load Balancer</a> and configures it according to the information in the Ingress and its associated Services.</p>
<p>-- <em><a href="https://cloud.google.com/kubernetes-engine/docs/concepts/ingress#ingress_for_external_and_internal_traffic" rel="nofollow noreferrer">Cloud.google.com: Kubernetes Engine: Ingress: Ingress for external and internal traffic</a></em></p>
</blockquote>
<p>Using different <code>Ingress</code> controllers like (nginx-ingress, traefik, <strong>kong</strong>) require you to use <code>Service</code> of type <code>LoadBalancer</code>.</p>
<p>Using above <code>Service</code> in <code>GKE</code> will automatically create <a href="https://cloud.google.com/load-balancing/docs/network" rel="nofollow noreferrer">External TCP/UDP Network Load Balancer</a> (L4) pointing to your <code>Ingress</code> controller. From this point the traffic will be redirected to specific services based on the <code>Ingress</code> resource with appropriate <code>ingress.class</code>.</p>
<blockquote>
<p>A tip!</p>
<p>You can see in the helm chart of Kong that it's using the same way!</p>
<ul>
<li><code>helm install kong/kong kong-ingress --dry-run --debug</code></li>
</ul>
</blockquote>
<p>To have the secure connection between the client and kong you will need to <strong>either</strong>:</p>
<ul>
<li>Use <code>cert-manager</code> to provision the certificates for the <code>Ingress</code> controller.
<ul>
<li><em><a href="https://cert-manager.io/docs/" rel="nofollow noreferrer">Cert-manager.io: Docs</a></em></li>
</ul>
</li>
<li>Provision the certificates in other way and provide them as a secret to be used by Ingress controller.
<ul>
<li><em><a href="https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets" rel="nofollow noreferrer">Kubernetes.io: Secret: TLS Secrets</a></em></li>
</ul>
</li>
</ul>
<blockquote>
<p><strong>Side note</strong>: In both ways the SSL termination will happen at the Ingress controller.</p>
</blockquote>
<hr />
<p>Answering the part of the question:</p>
<blockquote>
<p>The configuration to customize the LB should be made inside Kong's service (as I understand):</p>
<pre class="lang-yaml prettyprint-override"><code># values.yml (Kong, using Helm)
...
proxy:
  type: LoadBalancer
  annotations: {} &lt;-- Here
...
</code></pre>
<p>However, for GCP there are only a few according to the <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/load-balance-ingress#summary_of_external_ingress_annotations" rel="nofollow noreferrer">docs</a>, and none of them have the desire effect (cannot set certificate to use, define which type of LB to create, etc.)</p>
</blockquote>
<p>As said earlier <code>Service</code> of type <code>LoadBalancer</code> in <code>GKE</code> will configure L4 <code>TCP</code>/<code>UDP</code> LoadBalancer which is not designed to be responsible for handling SSL traffic (SSL termination).</p>
<hr />
<p>Additional resources:</p>
<ul>
<li><em><a href="https://cloud.google.com/load-balancing/docs/network" rel="nofollow noreferrer">Cloud.google.com: Load Balancing: Docs: Network</a></em></li>
<li><em><a href="https://github.com/Kong/kubernetes-ingress-controller" rel="nofollow noreferrer">Github.com: Kong: Kubernetes ingress controller</a></em></li>
</ul>
