<p>I'm Running a Kubernetes cluster on <code>AWS</code> using <code>Kops</code> for the first time and I need some help in exposing the services to the public with an AWS managed domain name and an SSL certificate. </p>

<p>The cluster is running in a private VPC and I can access it through a bastion instance.</p>

<p>Right now I'm exposing the services to the public using LoadBalancer service type as follow:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: my-gateway-service
  namespace: {{ .Values.nameSpace }}
  labels:
    app: gateway
    tier: backend
  annotations:
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: 'http'
      service.beta.kubernetes.io/aws-load-balancer-ssl-port: '{{ .Values.services.sslPort }}'
      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: '{{ .Values.services.sslCert }}'
spec:
  type: LoadBalancer
  selector:
    app: gateway
    tier: backend
  ports:
  - name: http
    port: 80
    targetPort: {{ .Values.applications.nodeAppPort }}
  - name: https
    port: 443
    targetPort: {{ .Values.applications.nodeAppPort }}
</code></pre>

<p>as you can see I'm passing the SSL certificate using annotations then I will just point the domain name to loadBalancer public ingress and done.</p>

<p><strong>The Problem:</strong>
This Project is a micro-services project and requires a lot of services to be exposed to the public in different environments which means a lot of <code>AWS LoadBalancers</code> and a lot of Money $$$$.</p>

<p>I've tried NodePort and ExternalName services but none of them worked because of the private VPC.</p>

<p>Any suggestions to overcome this problem?</p>

Adel Bachene
<p>Look into <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-controllers" rel="nofollow noreferrer">Ingress Controllers</a>. It's basically an nginx instance that's configured programmatically via annotations. There are several others available too (e.g., kong)</p>
