×

You can add TLS termination on the AWS Load Balancer.

Adding TLS termination on the AWS Load Balancer

You can route the traffic for the domain to pods of a service and add TLS termination on the AWS Load Balancer.

Prerequisites
  • You have an access to the OpenShift CLI (oc).

Procedure
  1. Install the Operator and create an instance of the aws-load-balancer-controller resource:

    apiVersion: networking.k8s.io/v1
    kind: AWSLoadBalancerController
    group: networking.olm.openshift.io/v1alpha1 (1)
    metadata:
      name: cluster
    spec:
      subnetTagging: Auto
      ingressClass: tls-termination (1)
    1 Defines the name of an ingressClass resource reconciled by the AWS Load Balancer Controller. This ingressClass resource gets created if it is not present. You can add additional ingressClass values. The controller reconciles the ingressClass values if the spec.controller is set to ingress.k8s.aws/alb.
  2. Create an Ingress resource:

    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
      name: <example> (1)
      annotations:
        alb.ingress.kubernetes.io/scheme: internet-facing (2)
        alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-west-2:xxxxx (3)
    spec:
      ingressClassName: tls-termination (4)
      rules:
      - host: <example.com> (5)
        http:
            paths:
              - path: /
                pathType: Exact
                backend:
                  service:
                    name: <example-service> (6)
                    port:
                      number: 80
    1 Specifies the name of an ingress.
    2 The controller provisions the load balancer for this Ingress resource in a public subnet so that the load balancer is reachable over the internet.
    3 The Amazon Resource Name of the certificate that you attach to the load balancer.
    4 Defines the ingress class name.
    5 Defines the domain for traffic routing.
    6 Defines the service for traffic routing.