<p>I kind of new on Kubernetes stuff and I'm trying to improve one current system we have here.
The Application is developed using Spring Boot and until now it was using HTTP (Port 8080) without any encryption. The system requirement is to enable e2e-encryption for all Data In-Transit. So here is the problem.</p>
<p>Currently, we have GCE Ingress with TLS enabled using Let's Encrypt to provide the Certificates on Cluster entrance. This is working fine. Our Ingress has some Path Rules to redirect the traffic to the correct microservice and those microservices are not using TLS on the communication.</p>
<p>I managed to create a Self-Signed certificate and embedded it inside the WAR and this is working on the Local machine just fine (using certificate validation disabled). When I deploy this on GKE, the GCP Health Check and Kubernetes Probes are not working at all (I can't see any communication attempt on the Application logs).</p>
<p>When I try to configure the Backend and Health Check on GCP changing both to HTTPS, they don't show any error, but after some time they quietly switch back to HTTP.</p>
<p>Here are my YAML files:</p>
<ol>
<li>admin-service.yaml</li>
</ol>
<pre class="lang-yaml prettyprint-override"><code>---
apiVersion: v1
kind: Service
metadata:
  name: admin-service
  namespace: default
spec:
  type: NodePort
  selector:
    app: admin
  ports:
  - port: 443
    targetPort: 8443
    name: https
    protocol: TCP
</code></pre>
<ol start="2">
<li>admin-deployment.yaml</li>
</ol>
<pre class="lang-yaml prettyprint-override"><code>---
apiVersion: &quot;apps/v1&quot;
kind: &quot;Deployment&quot;
metadata:
  name: &quot;admin&quot;
  namespace: &quot;default&quot;
  labels:
    app: &quot;admin&quot;
spec:
  replicas: 1
  selector:
    matchLabels:
      app: &quot;admin&quot;
  template:
    metadata:
      labels:
        app: &quot;admin&quot;
    spec:
      containers:
      - name: &quot;backend-admin&quot;
        image: &quot;gcr.io/my-project/backend-admin:X.Y.Z-SNAPSHOT&quot;
        livenessProbe:
          httpGet:
            path: /actuator/health/liveness
            port: 8443
            scheme: HTTPS
          initialDelaySeconds: 8
          periodSeconds: 30
        readinessProbe:
          httpGet:
            path: /actuator/health/readiness
            port: 8443
            scheme: HTTPS
          initialDelaySeconds: 8
          periodSeconds: 30
        env:
        - name: &quot;FIREBASE_PROJECT_ID&quot;
          valueFrom:
            configMapKeyRef:
              key: &quot;FIREBASE_PROJECT_ID&quot;
              name: &quot;service-config&quot;
---
apiVersion: &quot;autoscaling/v2beta1&quot;
kind: &quot;HorizontalPodAutoscaler&quot;
metadata:
  name: &quot;admin-etu-vk1a&quot;
  namespace: &quot;default&quot;
  labels:
    app: &quot;admin&quot;
spec:
  scaleTargetRef:
    kind: &quot;Deployment&quot;
    name: &quot;admin&quot;
    apiVersion: &quot;apps/v1&quot;
  minReplicas: 1
  maxReplicas: 3
  metrics:
  - type: &quot;Resource&quot;
    resource:
      name: &quot;cpu&quot;
      targetAverageUtilization: 80

</code></pre>
<ol start="3">
<li>ingress.yaml</li>
</ol>
<pre class="lang-yaml prettyprint-override"><code>---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: my-ingress-addr
    kubernetes.io/ingress.class: &quot;gce&quot;
    kubernetes.io/tls-acme: &quot;true&quot;
    cert-manager.io/cluster-issuer: &quot;letsencrypt-prod&quot;
    acme.cert-manager.io/http01-edit-in-place: &quot;true&quot;
    kubernetes.io/ingress.allow-http: &quot;false&quot;
spec:
  tls:
  - hosts:
    - my-domain.com
    secretName: mydomain-com-tls
  rules:
    - host: my-domain.com
      http:
        paths:
        - path: /admin/v1/*
          backend:
            serviceName: admin-service
            servicePort: 443
status:
  loadBalancer:
    ingress:
    - ip: XXX.YYY.WWW.ZZZ
</code></pre>
<p>Reading <a href="https://cloud.google.com/load-balancing/docs/ssl-certificates#backend-encryption" rel="nofollow noreferrer">this document from GCP</a> I understood that Loadbalancer it's compatible with Self-signed certificates.</p>
<p>I would appreciate any insight or new directions you guys can provide.
Thanks in advance.</p>
<p><strong>EDIT 1:</strong> I've added here the ingress YAML file which may help to a better understanding of the issue.</p>
<p><strong>EDIT 2:</strong> I've updated the deployment YAML with the solution I found for <em>liveness</em> and <em>readiness</em> probes (<code>scheme</code>).</p>
<p><strong>EDIT 3:</strong> I've found the solution for GCP Health Checks using annotation on Services declaration. I will put all the details on the response to my own question.</p>

BertKlinger
<p>Here is what I found on how to fix the issue.</p>
<p>After reading a lot of documentation related to Kubernetes and GCP I found a document on GCP explaining to use annotations on Service declaration. Take a look at lines 7-8.</p>
<pre class="lang-yaml prettyprint-override"><code>---
apiVersion: v1
kind: Service
metadata:
  name: admin-service
  namespace: default
  annotations:
    cloud.google.com/app-protocols: '{&quot;https&quot;:&quot;HTTPS&quot;}'
spec:
  type: NodePort
  selector:
    app: iteam-admin
  ports:
  - port: 443
    targetPort: 8443
    name: https
    protocol: TCP
</code></pre>
<p>This will hint GCP to create the <em><strong>backend-service</strong></em> and <em><strong>health-check</strong></em> using HTTPS and everything will work as expected.</p>
<p>Reference: <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/ingress-xlb#https_tls_between_load_balancer_and_your_application" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/concepts/ingress-xlb#https_tls_between_load_balancer_and_your_application</a></p>
