title: GKE, NGINX ingress, HTTPS, and certificates
body: <p>I have set up a Kubernetes cluster on GCP/GKE and it's all working well except for one thing. When I access the external IP for the service the (default?) &quot;Kubernetes Ingress Controller Fake Certificate&quot; is served.</p>
  <p>I am trying to use the NGINX Ingress (<a href="https://kubernetes.github.io/ingress-nginx/" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/</a>) and have followed what I believe are the correct instructions for associating a TLS secret with the Ingress. For example:</p>
  <blockquote>
  <p><a href="https://estl.tech/configuring-https-to-a-web-service-on-google-kubernetes-engine-2d71849520d" rel="nofollow noreferrer">https://estl.tech/configuring-https-to-a-web-service-on-google-kubernetes-engine-2d71849520d</a></p>
  <p><a href="https://kubernetes.github.io/ingress-nginx/user-guide/tls/" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/user-guide/tls/</a></p>
  </blockquote>
  <p>I have created a secret like this:</p>
  <pre><code>apiVersion: v1
  kind: Secret
  metadata:
    name: example-tls
    namespace: default
  data:
    tls.crt: [removed]
    tls.key: [removed]
  type: kubernetes.io/tls
  </code></pre>
  <p>And associated that secret (which I can confirm is applied correctly and I can see in the cluster config) with the Ingress like this:</p>
  <pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: example-ingress
    namespace: default
    annotations:
      kubernetes.io/ingress.class: &quot;nginx&quot;
      kubernetes.io/ingress.allow-http: &quot;false&quot;
      nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
      nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
      nginx.ingress.kubernetes.io/affinity: &quot;cookie&quot;
  spec:
    backend:
      serviceName: example-service
      servicePort: 80
    tls:
    - secretName: example-tls
  </code></pre>
  <p>From the documentation I feel that this should work (but, barring a bug, I am obviously mistaken!).</p>
  <p>I've also seen some documentation around requiring target proxies for HTTPS. Perhaps that is the way that I should be doing this?</p>
  <p>Many thanks for your help in advance.</p>
  <p>Cheers,
  Ben</p>
  <p>PS: This is my load balancer configuration:</p>
  <pre><code>kind: Service
  apiVersion: v1
  metadata:
    name: ingress-nginx
    namespace: ingress-nginx
    labels:
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
  spec:
    externalTrafficPolicy: Cluster
    loadBalancerIP: [removed]
    sessionAffinity: ClientIP
    type: LoadBalancer
    selector:
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/part-of: ingress-nginx
    ports:
      - name: http
        port: 80
        targetPort: http
      - name: https
        port: 443
        targetPort: https
  </code></pre>
  <p>Edit 1:
  Looking at my Ingress I can see this:</p>
  <pre><code>➜  gke git:(develop) ✗ kubectl describe ing example-tls-ingress
  Name:             example-tls-ingress
  Namespace:        default
  Address:          [removed]
  Default backend:  example-webapp-service:80 ([removed])
  TLS:
    example-tls terminates 
  Rules:
    Host  Path  Backends
    ----  ----  --------
    *     *     example-webapp-service:80 ([removed])
  </code></pre>
  <p>So it looks like the secret is picked up.</p>
  <p>And this makes me think that there is a difference between Ingress-terminated TLS and Load Balancer-terminated TLS?</p>