<p>I have a simple web server running in a single pod on GKE. I has also exposed it using a load balancer service. What is the easiest way to make this pod accessible over HTTPS?</p>
<pre><code>gcloud container clusters list
NAME              LOCATION       MASTER_VERSION    MASTER_IP     MACHINE_TYPE  NODE_VERSION      NUM_NODES  STATUS
personal.....  us-central1-a  1.19.14-gke.1900  34.69.....  e2-medium     1.19.14-gke.1900  1          RUNNING
kubectl get service
NAME           TYPE           CLUSTER-IP   EXTERNAL-IP      PORT(S)        AGE
kubernetes     ClusterIP      10.....    &lt;none&gt;           443/TCP        437d
my-service     LoadBalancer   10.....    34.71......      80:30066/TCP   12d

kubectl get pods
NAME                           READY   STATUS    RESTARTS   AGE
nodeweb-server-9pmxc       1/1     Running   0          2d15h
</code></pre>
<p>EDIT: I also have a domain name registered if it's easier to use that instead of https://34.71....</p>

nickponline
<p>First, your cluster should have Config Connector <a href="https://cloud.google.com/config-connector/docs/how-to/install-upgrade-uninstall#addon-configuring" rel="nofollow noreferrer">installed</a> and function properly.</p>
<p>Start by delete your existing load balancer service <code>kubectl delete service my-service</code></p>
<p>Create a static IP.</p>
<pre><code>apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeAddress
metadata:
  name: &lt;name your IP&gt;
spec:
  location: global
</code></pre>
<p>Retrieve the created IP <code>kubectl get computeaddress &lt;the named IP&gt; -o jsonpath='{.spec.address}'</code></p>
<p>Create an DNS &quot;A&quot; record that map your registered domain with the created IP address. Check with <code>nslookup &lt;your registered domain name&gt;</code> to ensure the correct IP is returned.</p>
<p>Update your load balancer service spec by insert the following line after <code>type: LoadBalancer</code>: <code>loadBalancerIP: &quot;&lt;the created IP address&gt;&quot;</code></p>
<p>Re-create the service and check <code>kubectl get service my-service</code> has the EXTERNAL-IP set correctly.</p>
<p>Create <code>ManagedCertificate</code>.</p>
<pre><code>apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: &lt;name your cert&gt;
spec:
  domains:
  - &lt;your registered domain name&gt;
</code></pre>
<p>Then create the Ingress.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: &lt;name your ingress&gt;
  annotations:
    networking.gke.io/managed-certificates: &lt;the named certificate&gt;
spec:
  rules:
  - host: &lt;your registered domain name&gt;
    http:
      paths:
      - pathType: ImplementationSpecific
        backend:
          service:
            name: my-service
            port:
              number: 80
</code></pre>
<p>Check with <code>kubectl describe ingress &lt;named ingress&gt;</code>, see the rules and annotations section.</p>
<p><strong>NOTE:</strong> It can take up to 15mins for the load balancer to be fully ready. Test with <code>curl https://&lt;your registered domain name&gt;</code>.</p>
