title: Enabling SSL on kubernates in GCE
body: <p>I'm in the process of enabling HTTPS to our kubernates clusters in GCE. I'm trying to utilize kubernates <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#tls" rel="noreferrer">Ingress</a></p>
  
  <p>I have the cert and priv key, and I have created a secret with these appended (ssl-secret):</p>
  
  <pre><code>apiVersion: v1
  kind: Secret
  metadata:
    name: ssl-secret
  type: Opaque
  data:
    tls.crt: LS0tLS...
    tls.key: Mc0c4t...
  </code></pre>
  
  <p>I also have an Ingress utilizing the secret (ssl-ingress):</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: ssl-ingress
  spec:
    backend:
      serviceName: client # Name of the service
      servicePort: my-https-port # Fetched from annotations
    tls:
    - hosts:
      - test.domain.se # My domain address
      secretName: ssl-secret # Name of my previously created secret
  </code></pre>
  
  <p>Finally, I try to apply these to my cluster with the following setup:</p>
  
  <pre><code>apiVersion: v1
  kind: Service
  metadata:
    name: client
    annotations:
      service.alpha.kubernetes.io/app-protocols: '{"my-https-port":"HTTPS"}'   # Must map port-name to HTTPS for the GCP ingress controller
    labels:
      app: client-pods
  spec:
    type: NodePort
    ports:
      - port: 12345 #To my understanding, not used
        targetPort: client-https
        protocol: TCP
        name: my-https-port
    selector:
      name: client-pods
  </code></pre>
  
  <p>So, my goal is that using this setup, I would be able to reach test.domain.se on <a href="https://test.domain.se" rel="noreferrer">https://test.domain.se</a>. But it just times out, while <a href="http://test.domain.se" rel="noreferrer">http://test.domain.se</a> works just fine.</p>
  
  <p>Describing the Ingress I get the following: </p>
  
  <pre><code>Name:                   ssl-ingress
  Namespace:              default
  Address:                35.186.253.27
  Default backend:        client:my-https-port ()
  TLS:
    ssl-secret terminates test.domain.se
  Rules:
  
    Host  Path    Backends
    ----  ----    --------
    *     *       client:my-https-port ()
  Annotations:
    static-ip:            k8s-fw-default-ssl-ingress--59114a8fc664f628
    target-proxy:         k8s-tp-default-ssl-ingress--59114a8fc664f628
    url-map:              k8s-um-default-ssl-ingress--59114a8fc664f628
    backends:             {"k8s-be-31894--59114a8fc664f628":"UNHEALTHY"}
    forwarding-rule:      k8s-fw-default-ssl-ingress--59114a8fc664f628
  Events:
    FirstSeen     LastSeen        Count   From                    SubObjectPath   Type            Reason  Message
    ---------     --------        -----   ----                    -------------   --------        ------  -------
    7m            7m              1       loadbalancer-controller                 Normal          ADD default/ssl-ingress
    6m            6m              1       loadbalancer-controller                 Normal          CREATE  ip: 35.186.253.27
    6m            2m              18      loadbalancer-controller                 Warning         GCE googleapi: Error 400: The SSL key could not be parsed.
    6m            2m              18      loadbalancer-controller                 Warning         Service failed to identify user specified default backend, couldn't find nodeport for default/client, using system default
  </code></pre>
  
  <p>So my questions are the following:</p>
  
  <blockquote>
    <p>Warning         GCE googleapi: Error 400: The SSL key could not be parsed.</p>
  </blockquote>
  
  <p>1: It seems like Ingress needs the priv key's passphrase. How do I add a passphrase to the secret (the key does have a known passphrase, but how do I inform the secret of it?)</p>
  
  <blockquote>
    <p>Warning         Service failed to identify user specified default backend, couldn't find nodeport for default/client, using system default</p>
  </blockquote>
  
  <p>2: It claims that it could not find nodeport for default/client. I have the target service client already running, but itseems the ingress appends default/ before the service name. Why, and how do I specify the client service?</p>