This message was deleted.

Can you elaborate a bit more? Which package are you in and which resource?

I am using k8s and aws packages.

Which ingress controller are you using? If you’re using Traefik, this is all driven via annotations on the

Service

objects

I am using the standard ELB via istio chart.

The last time I looked into this, my recollection was that kubernetes provided no way to find out what load balancer it had allocated in AWS. That seems like an unfortunate limitation of kubernetes if true. There may be a way to allocate the ELB yourself and ask kubernetes to use it instead of allocating it’s own though? @breezy-hamburger-69619 or @gorgeous-egg-16927 might have an idea?

This is getting more in depth than I really know, but our cluster has one

Service

of type

LoadBalancer

that creates an ELB automagically. You can throw some annotations on that

Service

to specify protocol, port, and ACM cert ARN. The ELB is all managed by Kubernetes

Indeed - if all you need is to be able to specify an ACM cert, you can use the annotation here: https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws The thing I believe you cannot do is ask Kubernetes what the id/arn of the loadbalancer it allocated is. But it does provide a few basic options for configuring the ELB via kubernetes annotations.

Ooh right, I think you are correct. All it gives you is the URL for it, which you could turn around and query AWS for, but it’s kind of a roundabout way of getting there

Luke’s link is the suggested path forward to getting a cert on an AWS LB that k8s spins up on a

LoadBalancer

typed Service. However, exposing a LB-typed service like this isn’t recommended as you directly put the application out there with no form of ingress management, rate limiting, proxying benefits etc. As an alternative, consider standing up any of the Ingress Controllers offered in the community with a LB of its own, to front your services, as it’ll provide you with host & path based routing management, can terminate SSL/TLS by leveraging k8s

Secrets

and provides OOTB functionality that your app may not natively have.