<p>I have an HTTP2 service. It's deployed on EKS (AWS Kubernetes). And I am trying to expose it to the internet.</p>
<p>If I am exposing it without TLS (with the code below) everything works fine. I can access it.</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: demoapp
spec:
  type: LoadBalancer
  ports:
  - name: http
    port:  80
    targetPort: 5000
  selector:
    name: demoapp
</code></pre>
<p>If I am adding TLS, I am getting HTTP 502 (Bad Gateway).</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: demoapp
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: somearn
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: &quot;https&quot;  
spec:
  type: LoadBalancer
  ports:
  - name: https
    port: 443
    targetPort: 5000
  selector:
    name: demoapp
</code></pre>
<p>I have a guess (which could be wrong) that <code>service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http</code> for reason assumes that it's HTTP 1.1 (vs HTTP 2.0) and bark when one of the sides start sending binary (vs textual data).</p>
<p>Additional note: I am not using any Ingress controller.</p>
<p>And a thought. Potentially, I can bring TLS termination within the app (vs doing it on the load balancer) and switch as an example to NLB. However, brings a lot of hair in the solution and I would rather use load balancer for it.</p>

Victor Ronin
<p>Base on the annotations in your question; the TLS should terminate at the CLB and you should remove <code>service.beta.kubernetes.io/aws-load-balancer-backend-protocol</code> (default to <code>tcp</code>).</p>
