<p>I am installing <code>jenkins</code> on GKE.</p>

<p>I want to use <code>ingress</code> (so to avoid the <code>LoadBalancer</code>) but I also want it to have TLS enabled.</p>

<p><a href="https://github.com/helm/charts/blob/master/stable/jenkins/values.yaml#L343" rel="nofollow noreferrer">Here</a> are the <code>ingress</code> - related <code>values</code>:</p>

<pre><code>  ingress:
    enabled: false
    # For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1'
    apiVersion: "extensions/v1beta1"
    labels: {}
    annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
    # Set this path to jenkinsUriPrefix above or use annotations to rewrite path
    # path: "/jenkins"
    # configures the hostname e.g. jenkins.example.com
    hostName:
    tls:
    # - secretName: jenkins.cluster.local
    #   hosts:
    #     - jenkins.cluster.local
</code></pre>

<p>Assuming I already have a <code>CloudDNS</code> (routable to <code>my-network.mydomain.net</code>) and I want <code>jenkins</code> accessible via <code>jenkins.my-network.mydomain.net</code>, how should I configure the above values?</p>

<p>What is the usefulness of the <code>values.ingress.tls.secretName</code>? </p>

<p>In case I enable <code>tls</code>, what will be the issuing authority of the corresponding certificate? Is this handled automatically by GCP?</p>

pkaramol
<p>The ingress that you will setup will need one loadBalancer. This load balancer will be receiving traffic from client and forward it to the ingress controller(gke ingress, nginx etc). So you are really not avoiding loadbalancer completely in this case.</p>

<p>The ingress is used to avoid creation of load balancers exponentially if you are using kubernetes service of type LoadBalancer to serve external clients.In your case the jenkins master service instead of exposing via load balancer directly you can choose an ingress to avoid more than one load balancer creation. </p>

<blockquote>
  <p>What is the usefulness of the values.ingress.tls.secretName?</p>
</blockquote>

<p>It tells the Ingress controller to secure the channel from the client to the load balancer using TLS. You need to make sure the TLS secret you created came from a certificate that contains a Common Name (CN), also known as a Fully Qualified Domain Name (FQDN) for jenkins.cluster.local.</p>

<p>You also need to create a secret with name jenkins.cluster.local</p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: jenkins.cluster.local
  namespace: default
data:
  tls.crt: base64 encoded cert
  tls.key: base64 encoded key
type: kubernetes.io/tls
</code></pre>

<blockquote>
  <p>In case I enable tls, what will be the issuing authority of the
  corresponding certificate? Is this handled automatically by GCP?</p>
</blockquote>

<p>It's not automatically handled by GCP. Check Options for providing SSL certificates section from the <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/ingress" rel="nofollow noreferrer">official docs</a>
Out of all 3 options I believe you need to follow Self-managed certificates as Secret resources and provision your own SSL certificate and create a Secret to hold it. You can then refer to the Secret in an Ingress specification to create an HTTP(S) load balancer that uses the certificate. Refer to the <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-multi-ssl" rel="nofollow noreferrer">instructions</a> for using certificates in Secrets for more information.</p>
